Hewlett-Packard ColorLaserJetEnterprisePrinterM750Series ...Hewlett-Packard...

Hewlett-PackardLaserJet Enterprise Printer M712 Series,LaserJet Enterprise Printer M806 Series,Color LaserJet Enterprise Printer M651 Series,Color LaserJet Enterprise Printer M750 Series,Color LaserJet Enterprise Printer M855 Series,andOfficeJet Enterprise Color Printer X555 SeriesFirmware with Jetdirect InsideSecurity Target

2.0Version:FinalStatus:2014-10-07Last Update:

TrademarksThe following term is a trademark of atsec information security corporation in the United States,other countries, or both:

● atsec®The following terms are trademarks of The Institute of Electrical and Electronics Engineers,Incorporated in the United States, other countries, or both:

● 2600.2™● IEEE®

The following term is a trademark of Massachusetts Institute of Technology (MIT) in the UnitedStates, other countries, or both:

● Kerberos™The following terms are trademarks of Microsoft Corporation in the United States, other countries,or both:

● Microsoft®● Windows®

The following term is a trademark of SafeNet, Inc. in the United States, other countries, or both:● SafeNet®

Legal NoticeThis document is provided AS IS with no express or implied warranties. Use the information in thisdocument at your own risk.This document may be reproduced or distributed in any form without prior permission provided thecopyright notice is retained on all copies. Modified versions of this documentmay be freely distributedprovided that they are clearly identified as such, and this copyright is included intact.

Revision HistoryChanges to Previous RevisionAuthor(s)DateRevisionFinal ST.Scott Chapman,

atsec2014-10-072.0

of 83Version: 2.0Copyright © 2008-2014 by atsec information security corporation and Hewlett-Packard

Development Company, L.P. or its wholly owned subsidiaries.Last update: 2014-10-07

Hewlett-Packard Development Company, L.P.HP LaserJet Enterprise Printer M712 & M806 Series,

Color LaserJet Enterprise Printer M651, M750 & M855Series, & OfficeJet Enterprise Color Printer X555 Series

Firmware w/Jetdirect Inside ST

Table of Contents1 Introduction .................................................................................................... 9

1.1 Security Target Identification ......................................................................................... 91.2 TOE Identification .......................................................................................................... 91.3 TOE Type ....................................................................................................................... 91.4 TOE Overview ................................................................................................................ 9

1.4.1 Required and optional non-TOE hardware, software, and firmware .................... 101.4.2 Intended method of use ...................................................................................... 11

1.5 TOE Description ........................................................................................................... 121.5.1 TOE architecture ................................................................................................. 121.5.2 TOE security functionality (TSF) summary .......................................................... 17

1.5.2.1 Auditing ...................................................................................................... 171.5.2.2 Cryptography ............................................................................................. 171.5.2.3 Identification and authentication ................................................................ 171.5.2.4 Data protection and access control ............................................................ 191.5.2.5 Protection of the TSF .................................................................................. 201.5.2.6 TOE access protection ................................................................................ 211.5.2.7 Trusted channel communication and certificate management .................. 211.5.2.8 User and access management ................................................................... 21

1.5.3 TOE boundaries ................................................................................................... 211.5.3.1 Physical ...................................................................................................... 211.5.3.2 Logical ........................................................................................................ 221.5.3.3 Evaluated configuration ............................................................................. 22

1.5.4 Security policy model .......................................................................................... 231.5.4.1 Subjects/Users ............................................................................................ 231.5.4.2 Objects ....................................................................................................... 241.5.4.3 SFR package functions ............................................................................... 261.5.4.4 SFR package attributes .............................................................................. 26

2 CC Conformance Claim ................................................................................... 272.1 Protection Profile tailoring and additions ..................................................................... 27

2.1.1 IEEE Std 2600.2-2009; "2600.2-PP, Protection Profile for Hardcopy Devices,Operational Environment B" (with NIAP CCEVS Policy Letter #20) ([PP2600.2]) ........... 272.1.2 SFR Package for Hardcopy Device Document Storage and Retrieval (DSR) Functions([PP2600.2-DSR]) ........................................................................................................... 312.1.3 SFR Package for Hardcopy Device Print Functions ([PP2600.2-PRT]) .................. 312.1.4 SFR Package for Hardcopy Device Shared-medium Interface Functions([PP2600.2-SMI]) ............................................................................................................ 31

3 Security Problem Definition ............................................................................ 323.1 Introduction ................................................................................................................. 323.2 Threat Environment ..................................................................................................... 32

3.2.1 Threats countered by the TOE ............................................................................ 323.3 Assumptions ................................................................................................................ 33

3.3.1 Environment of use of the TOE ........................................................................... 33






3.3.1.1 Physical ...................................................................................................... 333.3.1.2 Personnel .................................................................................................... 333.3.1.3 Connectivity ............................................................................................... 33

3.4 Organizational Security Policies ................................................................................... 343.4.1 Included in the PP2600.2 protection profile ........................................................ 343.4.2 In addition to the PP2600.2 protection profile ..................................................... 34

4 Security Objectives ........................................................................................ 354.1 Objectives for the TOE ................................................................................................. 354.2 Objectives for the Operational Environment ................................................................ 354.3 Security Objectives Rationale ...................................................................................... 37

4.3.1 Coverage ............................................................................................................. 374.3.2 Sufficiency ........................................................................................................... 38

5 Extended Components Definition .................................................................... 445.1 Class FPT: Protection of the TSF .................................................................................. 44

5.1.1 Restricted forwarding of data to external interfaces (FDI) .................................. 445.1.1.1 FPT_FDI_EXP.1 - Restricted forwarding of data to external interfaces ........ 44

6 Security Requirements ................................................................................... 456.1 TOE Security Functional Requirements ........................................................................ 45

6.1.1 Security audit (FAU) ............................................................................................ 466.1.1.1 Audit data generation (FAU_GEN.1) .......................................................... 466.1.1.2 User identity association (FAU_GEN.2) ...................................................... 47

6.1.2 Cryptographic support (FCS) ............................................................................... 476.1.2.1 Cryptographic key generation (FCS_CKM.1) .............................................. 476.1.2.2 Cryptographic key distribution (FCS_CKM.2) ............................................. 486.1.2.3 Cryptographic operation (FCS_COP.1-ipsec) .............................................. 486.1.2.4 Cryptographic operation (FCS_COP.1-job) ................................................. 49

6.1.3 User data protection (FDP) .................................................................................. 496.1.3.1 Common access control SFP (FDP_ACC.1-cac) .......................................... 496.1.3.2 TOE function access control SFP (FDP_ACC.1-tfac) .................................... 506.1.3.3 Common access control functions (FDP_ACF.1-cac) .................................. 516.1.3.4 TOE function access control functions (FDP_ACF.1-tfac) ........................... 516.1.3.5 Subset residual information protection (FDP_RIP.1) .................................. 52

6.1.4 Identification and authentication (FIA) ................................................................ 526.1.4.1 Local user attribute definition (FIA_ATD.1) ................................................ 526.1.4.2 Verification of secrets (FIA_SOS.1) ............................................................ 526.1.4.3 Timing of Control Panel authentication (FIA_UAU.1) .................................. 526.1.4.4 IPsec authentication before any action (FIA_UAU.2) .................................. 526.1.4.5 Control Panel protected authentication feedback (FIA_UAU.7) .................. 536.1.4.6 Timing of Control Panel identification (FIA_UID.1) ..................................... 536.1.4.7 IPsec identification before any action (FIA_UID.2) ..................................... 536.1.4.8 User-subject binding (FIA_USB.1) .............................................................. 53

6.1.5 Security management (FMT) ............................................................................... 536.1.5.1 Management of authentication security functions behavior (FMT_MOF.1)................................................................................................................................. 53






6.1.5.2 Management of Permission Set security attributes (FMT_MSA.1-perm) .... 546.1.5.3 Management of TOE function security attributes (FMT_MSA.1-tfac) .......... 546.1.5.4 Management of TSF data (FMT_MTD.1-auth) ............................................. 546.1.5.5 Management of TSF data (FMT_MTD.1-users) ........................................... 546.1.5.6 Specification of management functions (FMT_SMF.1) ............................... 546.1.5.7 Security roles (FMT_SMR.1) ....................................................................... 55

6.1.6 Protection of the TSF (FPT) .................................................................................. 556.1.6.1 Restricted forwarding of data to external interfaces (FPT_FDI_EXP.1) ...... 556.1.6.2 Reliable time stamps (FPT_STM.1) ............................................................. 556.1.6.3 TSF testing (FPT_TST.1) ............................................................................. 55

6.1.7 TOE access (FTA) ................................................................................................ 556.1.7.1 Control Panel TSF-initiated termination (FTA_SSL.3) ................................. 55

6.1.8 Trusted path/channels (FTP) ............................................................................... 566.1.8.1 Inter-TSF trusted channel (FTP_ITC.1) ....................................................... 56

6.2 Security Functional Requirements Rationale ............................................................... 566.2.1 Coverage ............................................................................................................. 566.2.2 Sufficiency ........................................................................................................... 586.2.3 Security requirements dependency analysis ...................................................... 636.2.4 Internal consistency and mutual support of SFRs ............................................... 66

6.3 Security Assurance Requirements ............................................................................... 666.4 Security Assurance Requirements Rationale ............................................................... 67

7 TOE Summary Specification ............................................................................ 687.1 TOE Security Functionality ........................................................................................... 68

7.1.1 Auditing ............................................................................................................... 687.1.2 Cryptography ...................................................................................................... 687.1.3 Identification and authentication (I&A) ............................................................... 69

7.1.3.1 Control Panel I&A ....................................................................................... 697.1.3.2 IPsec I&A .................................................................................................... 70

7.1.4 Data protection and access control ..................................................................... 717.1.4.1 Permission Sets .......................................................................................... 717.1.4.2 Job PINs ...................................................................................................... 727.1.4.3 Job Encryption Passwords ........................................................................... 727.1.4.4 Common access control ............................................................................. 727.1.4.5 TOE function access control ....................................................................... 737.1.4.6 Residual information protection ................................................................. 74

7.1.5 Protection of the TSF ........................................................................................... 747.1.5.1 Restricted forwarding of data to external interfaces .................................. 747.1.5.2 TSF self-testing ........................................................................................... 747.1.5.3 Reliable timestamps ................................................................................... 74

7.1.6 TOE access protection ......................................................................................... 757.1.6.1 Inactivity timeout ....................................................................................... 75

7.1.7 Trusted channel communication and certificate management ........................... 757.1.8 User and access management ............................................................................ 77

8 Abbreviations, Terminology and References .................................................... 78






8.1 Abbreviations ............................................................................................................... 788.2 Terminology ................................................................................................................. 808.3 References ................................................................................................................... 81






List of TablesTable 1: TOE Reference ........................................................................................................ 10Table 2: IPsec user mappings to allowed network protocols ................................................ 18Table 3: Users ....................................................................................................................... 23Table 4: User Data ................................................................................................................ 24Table 5: TSF Data ................................................................................................................. 25Table 6: TSF Data Listing ...................................................................................................... 25Table 7: SFR package functions ............................................................................................ 26Table 8: SFR package attributes ........................................................................................... 26Table 9: SFR mappings between 2600.2 and the ST ............................................................ 27Table 10: SFR mappings of non-PP2600.2 SFRs and the ST (in the ST, but not required by or

hierarchical to SFRs in PP2600.2) ................................................................................... 30Table 11: SFR mappings between 2600.2-DSR and the ST .................................................. 31Table 12: SFR mappings between 2600.2-PRT and the ST ................................................... 31Table 13: SFR mappings between 2600.2-SMI and the ST ................................................... 31Table 14: Mapping of security objectives to threats and policies ......................................... 37Table 15: Mapping of security objectives for the Operational Environment to assumptions,

threats and policies ........................................................................................................ 38Table 16: Sufficiency of objectives countering threats ......................................................... 38Table 17: Sufficiency of objectives holding assumptions ..................................................... 40Table 18: Sufficiency of objectives enforcing Organizational Security Policies .................... 41Table 19: Security functional requirements for the TOE ....................................................... 45Table 20: Auditable events ................................................................................................... 47Table 21: Cryptographic key generation .............................................................................. 48Table 22: Cryptographic key distribution ............................................................................. 48Table 23: Cryptographic operations ..................................................................................... 49Table 24: Cryptographic operations ..................................................................................... 49Table 25: Common Access Control SFP ................................................................................ 50Table 26: Mapping of security functional requirements to security objectives ..................... 56Table 27: Security objectives for the TOE rationale ............................................................. 58Table 28: TOE SFR dependency analysis .............................................................................. 63Table 29: Security assurance requirements ......................................................................... 66Table 30: Trusted channel connections ................................................................................ 75






List of FiguresFigure 1: HCD physical diagram ........................................................................................... 12Figure 2: HCD logical diagram .............................................................................................. 16






1 Introduction

1.1 Security Target IdentificationHewlett-Packard LaserJet Enterprise Printer M712 Series, LaserJet EnterprisePrinter M806 Series, Color LaserJet Enterprise Printer M651 Series, Color LaserJetEnterprise Printer M750 Series, Color LaserJet Enterprise Printer M855 Series,and OfficeJet Enterprise Color Printer X555 Series Firmware with Jetdirect InsideSecurity Target

Title:

2.0Version:FinalStatus:2014-10-07Date:Hewlett-Packard Development Company, L.P.Sponsor:Hewlett-Packard Development Company, L.P.Developer:CSECCertification Body:CSEC2014002Certification ID:Hewlett-Packard, HP, Color LaserJet, LaserJet, OfficeJet, inkjet, M651, M712,M750, M806, M855, X555, hardcopy device, HCD, printer, Jetdirect Inside.

Keywords:

1.2 TOE IdentificationThe TOE is the Hewlett-Packard LaserJet Enterprise Printer M712 Series, LaserJet Enterprise PrinterM806 Series, Color LaserJet Enterprise Printer M651 Series, Color LaserJet Enterprise Printer M750Series, Color LaserJet Enterprise Printer M855 Series, and OfficeJet Enterprise Color Printer X555Series Firmware with Jetdirect Inside.

1.3 TOE TypeThe TOE type is the internal firmware providing the functionality of a network printer.

1.4 TOE OverviewThe TOE models are network printers designed to be shared by many client computers and users.These products are designed to meet the requirements of the [PP2600.2] protection profile inconjunction with [CCEVS-PL20] in the environment defined by these two documents (the PolicyLetter modifies the requirements and environment).The TOE contains functions for storing print jobs and printing print jobs received from networkedcomputers. These hardcopy devices (HCDs), as they are called in [PP2600.2], are self-containedunits that include processors, memory, networking, a storage drive, and a print engine. The operatingsystem, web servers, and Control Panel applications (i.e., applications that run internally on theHCD) reside within the firmware of the HCD.The TOE is the contents of the firmware with the exception of the operating system and the QuickSeccryptographic library (used by IPsec), which are part of the Operational Environment.The printer models for which the firmware is evaluated are listed in the following table along withthe evaluated firmware version numbers for each model:






TOE Firmware VersionPrinter (HCD) Model

System Firmware version: 2302786_433714Jetdirect Inside version: JDI23230013

LaserJet Enterprise Printer M712 Series(M712xh, M712dn, M712n)


LaserJet Enterprise Printer M806 Series(M806+, M806+ NFC/Wireless Direct, M806dn)


Color LaserJet Enterprise Printer M651 Series(M651xh, M651dn, M651n)


Color LaserJet Enterprise Printer M750 Series(M750xh, M750dn, M750n)


Color LaserJet Enterprise Printer M855 Series(M855xh, M855dn, M855+ NFC/Wireless Direct)


OfficeJet Enterprise Color Printer X555 Series(X555xh, X555dn)

Table 1: TOE Reference

Each model provides the following security features:● Auditing● Cryptography● Identification and authentication● Data protection and access control● Protection of the TSF (restricted forwarding, TSF self-testing, timestamps)● TOE access protection (inactivity timeout)● Trusted channel communication and certificate management● User and access management

1.4.1 Required and optional non-TOE hardware, software, andfirmwareThe following required firmware components are considered part of the Operational Environment:

● Operating system (included in the firmware)● QuickSec cryptographic library module (included in the firmware)

The hardware portion of the HP printer models is considered part of the Operational Environment.The TOE is evaluated on all of the HP printer models defined in Table 1 and requires one of thesemodels in order to run in the evaluated configuration.The following required components are part of the Operational Environment:

● DNS server● NTP server● Syslog server● WINS server






● One administrative client computer network connected to the TOE in the role of anAdministrative Computer

The following optional components are part of the Operational Environment:● HP Print Drivers, including the HP Universal Print Driver, for client computers (for submitting

print job requests from client computers)● HP Web Jetadmin administrative tool● Windows domain controller/Kerberos server● LDAP server● Client computers network connected to the TOE in a non-administrative computer role● CIFS for administrative backup and restore of customer-specific configuration settings and

TSF data (local user account data)● SMTP gateway● Web browser

1.4.2 Intended method of use[PP2600.2] is defined for a commercial information processing environment in which a moderatelevel of document security, network security, and security assurance are required.The TOE is intended to be used in non-hostile, networked environments where TOE users havedirect physical access to the HCDs for printing. The physical environment should be reasonablycontrolled and/or monitored where physical tampering of the HCDs would be evident and noticed.The TOE can be connected to multiple client computers via a local area network using HP's JetdirectInside in the evaluated configuration. The evaluated configuration uses secure network mechanismsfor communication between the network computers and the TOE. The TOE is managed by onedesignated administrative computer. The TOE is not intended be connected to the Internet.The evaluated configuration contains a built-in user identification and authentication database(a.k.a. sign in method) used for Local Device Sign In that is part of the TOE. It also supports aWindows domain controller (via Kerberos) for a feature called Windows Sign In and a LightweightDirectory Access Protocol (LDAP) authentication server for a feature called LDAP Sign In to identifyand authenticate users. The Windows domain controller and LDAP server are part of the OperationalEnvironment.The evaluated configuration supports the optional HPWeb Jetadmin administrative tool for managingthe TOE. This tool uses the Hypertext Transfer Protocol (HTTP), Hypertext Markup Language (HTML),Simple Object Access Protocol (SOAP), Extensible Markup Language (XML), Open ExtensibilityPlatform device layer (OXPd) Web Services, WS-* Web Services, and Simple Network ManagementProtocol (SNMP) to communicate to the TOE. (The Web Jetadmin administrative tool is part of theOperational Environment.) The evaluated configuration also supports the Embedded Web Server(EWS) interface for managing the TOE using a web browser over HTTP. (Web browsers are part ofthe Operational Environment.)The Universal Serial Bus (USB) ports are disabled in the evaluated configuration.






1.5 TOE Description

1.5.1 TOE architectureAs mentioned previously, the TOE is the firmware of a printer designed to be shared by many clientcomputers and human users. It performs the functions of storing and printing print jobs. It can beconnected to a local network through the embedded Jetdirect Inside's built-in Ethernet.

Figure 1: HCD physical diagram






Figure 1 shows a high-level physical diagram of an HCD with the unshaded areas representing theTOE and the shaded areas indicating components that are part of the Operational Environment.At the top of this figure is the Administrative Computer which connects to the TOE using InternetProtocol Security (IPsec) with X.509v3 certificates for both mutual authentication and for protectionof data from disclosure and alteration. This computer can administer the TOE using the followinginterfaces over the IPsec connection:

● Embedded Web Server (EWS)● Simple Network Management Protocol (SNMP)● Web Services:

❍ Open Extensibility Platform device (OXPd) Web Services❍ WS-* Web Services

The HTTP-based EWS administrative interface allows administrators to remotely manage the featuresof the TOE using a web browser.The Web Services allow administrators to manage the TOE using HP's Web Jetadmin application,which is part of the Operational Environment. The TOE supports both HP's Open Extensibility Platformdevice (OXPd) Web Services and certain WS-* Web Services (conforming to the WS-* standardsdefined by w3.org) accessed via the Simple Object Access Protocol (SOAP) and Extensible MarkupLanguage (XML).The SNMP network interface allows administrators to remotely manage the TOE using externalSNMP-based administrative applications like the HP Web Jetadmin administrative tool.Printer Job Language (PJL) is used in a non-administrative capacity by the Administrative Computer.The Administrative Computer uses PJL to send print jobs to the TOE as well as to receive job status.In general, PJL supports password protected administrative commands, but in the evaluatedconfiguration these commands are disabled. For the purposes of this Security Target, we definethe PJL Interface as PJL data sent to port 9100.The TOE protects all network communications with Internet Protocol Security (IPsec), which is partof the embedded Jetdirect Inside firmware. Though IPsec supports multiple authentication methods,in the evaluated configuration, both ends of the IPsec connection are authenticated using X.509v3certificates. An identity certificate for the TOE must be created outside the TOE, signed by aCertificate Authority (CA), and imported (added) into the TOE with the Certificate Authority's CAcertificate.Because IPsec authenticates the computers (IPsec authenticates the computer itself; IPsec doesnot authenticate the individual users of the computer), access to the Administrative Computershould be restricted to TOE administrators only.The TOE distinguishes between the Administrative Computer and Network Client Computers byusing IP addresses, IPsec, and the embedded Jetdirect Inside's internal firewall. In the evaluatedconfiguration, the number of Administrative Computers used to manage the TOE is limited to oneand the Device Administrator Password must be set.The evaluated configuration supports the following SNMP versions:

● SNMPv1 read-only● SNMPv2c read-only● SNMPv3






Network Client Computers connect to the TOE using IPsec with X.509v3 certificates to protect thecommunication and to mutually authenticate. These client computers can send print jobs to theTOE using the PJL Interface as well as receive job status.The TOE protects stored jobs with either a 4-digit Job PIN or by accepting (and storing) an encryptedjob from a client computer. Both protection mechanisms are optional by default and are mutuallyexclusive of each other if used. In the evaluated configuration, every job must either be assigneda 4-digit Job PIN or be an encrypted job.The TOE supports the Common Internet File System (CIFS) protocol. CIFS is used by administratorsto backup and restore customer-specific configuration settings and TSF data (local user accountdata). (It does not backup job files.) Only administrators can access the CIFS through the TOE. Theconnection is protected using IPsec.The TOE can send email alert messages to client computers and to HP. In addition, the TOE'sAutoSend feature can send automated emails regarding product configuration and printer suppliesto administrator-specified email addresses. The TOE supports protected communications betweenthe TOE and Simple Mail Transfer Protocol (SMTP) gateways. It uses IPsec with X.509v3 certificatesto protect the communications and to mutual authenticate with the SMTP gateway. The TOE canonly protect unencrypted email up to the SMTP gateway. It is the responsibility of the OperationalEnvironment to protect emails from the SMTP gateway to the email's destination. Also, the TOEcan only send emails; it does not accept inbound emails.Each HCD contains a user interface called the Control Panel. The Control Panel is the physicalinterface that a user uses to communicate with the TOE when physically using the HCD. Dependingon the model, the Control Panel may have a 4-line, non-touchscreen display (M712 and M750) ora 4.3-inch touchscreen display. Each Control Panel has an "Easy Access" USB port which is disabledin the evaluated configuration. Each Control Panel also has a set of physical buttons whose quantitiesand functions vary between models. Users use the Control Panel to sign in to the TOE and performfunctions such as accessing and printing stored print jobs. When a user signs in at the Control Panel,a Permission Set is associated with that user's session which determines the functions the user ispermitted to perform.The Control Panel supports both local and remote sign in methods. The local sign in method iscalled Local Device Sign In which supports individual user accounts. The user account informationis maintained in the Local Device Sign In database within the TOE. The remote sign in methods arecalled LDAP Sign In and Windows Sign In (Kerberos). The TOE uses IPsec with X.509v3 certificatesto protect both the LDAP and Kerberos communications.The Print Engine in Figure 1 converts electronic format into hardcopy.All printer models contain a persistent storage drive (a.k.a. storage drive) that resides in theOperational Environment. The storage drive contains a section called Job Storage which is auser-visible file system where stored print jobs are stored/held. Depending on the printer model,the storage drive is either a:

● Solid-State Drive (SSD), or● HP High Performance Secure Hard Disk

If the printer model contains an SSD, all jobs in Job Storage are automatically deleted when theHCD is power-cycled. If the printer model contains an HP High Performance Secure Hard Disk, thejobs can persist across power-cycles or can be deleted, depending on how the administratorconfigures the TOE and on the job type. (Job types are discussed in section 1.5.4.2.1.)






The TOE supports the auditing of security relevant functions by generating and forwarding auditrecords to a remote syslog server. The TOE uses IPsec with X.509v3 certificates to protect thecommunications between the TOE and the syslog server and to mutually authenticate the TOE andsyslog server.The Jetdirect Inside Firmware and HCD System Firmware components comprise the firmware onthe system. They are shown as two separate components but they both share the same operatingsystem (OS). The operating system is part of the Operational Environment. Both firmwarecomponents also contain an Embedded Web Server (EWS).The Jetdirect Inside firmware includes SNMP, IPsec, a firewall, and the management functions formanaging these network-related features. The Jetdirect Inside firmware also provides the networkstack and drivers controlling the TOE's Ethernet interface.The HCD System Firmware controls the overall functions of the TOE from the Control Panel to thestorage drive to the print jobs.Figure 2 shows the HCD boundary in grey and the firmware (TOE) boundary in blue (the TOE beingcomprised of the HCD System firmware and the Jetdirect Inside firmware excluding the underlyingoperating system and the QuickSec cryptographic library). The Jetdirect Inside firmware providesthe network connectivity and network device drivers used by the HCD System firmware. The HCDSystem firmware and Jetdirect Inside firmware share the same operating system (which is part ofthe Operational Environment). The HCD System firmware also includes internal Control Panelapplications that drive the functions of the TOE. Both firmware components work together to providethe security functionality defined in this document for the TOE.






Figure 2: HCD logical diagram






1.5.2 TOE security functionality (TSF) summary

1.5.2.1 AuditingThe TOE performs auditing of security relevant functions. Both the Jetdirect Inside and HCD Systemfirmware generate audit records. The TOE connects and sends audit records to a syslog server forlong-term storage and audit review. (The syslog server is part of the Operational Environment.)

1.5.2.2 CryptographyThe TOE uses IPsec to protect its communications channels. The QuickSec cryptographic library,which is part of the Operational Environment, is used to supply the cryptographic algorithms forIPsec. See section 1.5.2.7 for more information.The TOE supports the decrypting of print jobs encrypted using the Job Encryption Password. Thedecryption algorithm used by the TOE for this is included in the TOE. See section 1.5.2.4.3 for moreinformation.

1.5.2.2.1 Cryptography outside the scope of the TOEThis section exists to inform the reader that the HCD contains other cryptography that is outsidethe scope of the TOE, is not part of this evaluation, and is not used to fulfill any of the [PP2600.2]requirements.The HP High Performance Secure Hard Disk provides hardware-based cryptography and persistentstorage to securely manage sensitive print data. Data on this drive is encrypted and the encryptionkey is locked to the device. The cryptographic functionality is transparent to the TOE and to theuser. Not all printer models in this evaluation contain this drive. The printer models that do not,instead contain an SSD.The SSDs are encrypted under the control of the TOE using the HCD's hardware. Each time the TOEis power-cycled, the cryptographic keys are destroyed and new keys generated to encrypt thedrive. Because of this, the jobs in Job Storage are effectively erased upon power-cycling the HCD.

1.5.2.3 Identification and authentication

1.5.2.3.1 Control Panel I&AAll HCDs have a Control Panel used to select a function (a.k.a. Control Panel application) to beperformed, such as Print. The Control Panel supports both local and remote sign in methods.The mechanism for the local sign in method, which is part of the TOE firmware, is called:

● Local Device Sign InRemote sign in methods used by the TOE are:

● LDAP Sign In● Windows Sign In (via Kerberos)

For successful remote authentication, Control Panel users must enter their username and passwordas defined by the remote sign in method.All users must sign in before being presented with the home screen allowing access to ControlPanel applications. Prior to signing in, the user may select a sign in method, sign in, or get help onvarious printer functions.






When users sign in through the Control Panel, the TOE displays asterisks or dots (depending on themodel) for each character of a PIN, Access Code, or password typed to prevent onlookers fromviewing another user's authentication data.

1.5.2.3.2 IPsec I&AClient computers can connect to the TOE to submit print jobs and to manage the TOE. The TOEuses IPsec to identify and mutually authenticate client computers that attempt to connect to theTOE.The client computers that connect to the TOE are considered IPsec users and are classified as eitherNetwork Client Computers or the Administrative Computer. The TOE uses IP addresses to identifythese users and X.509v3 certificates to authenticate the users. The IP address of a connecting clientcomputer must be defined to the TOE's IPsec firewall in order for the computer to be consideredauthorized to access the TOE. Any client computer not defined to the TOE's IPsec/Firewall isconsidered unauthorized and is blocked by the firewall from accessing the TOE.The TOE uses IPsec/Firewall address templates, service templates, and rules to map IP addressesto network service protocols. An address template contains one or more IP addresses. A servicetemplate contains one or more allowed network service protocols. A rule contains a mapping of anaddress template to a service template. Through the rules, an administrator determines the UserRole of the client computers (i.e., the administrator determines which client computer is theAdministrative Computer and which client computers are the Network Client Computers).In the evaluated configuration, the IPsec/firewall only allows the Administrative Computer to connectto all interfaces supported by the TOE. The Network Client Computers are limited to just the PJLInterface (TCP port 9100). Table 2 shows the mapping of IPsec users to their allowed networkprotocols.

Allowed network protocol accessIPsec user

EWS (HTTP), OPXd, WS-*, SNMP, PJLAdministrative Computer(U.ADMINISTRATOR)

PJL (TCP port 9100 only)Network Client Computer(U.NORMAL)

Table 2: IPsec user mappings to allowed network protocols

Because IPsec mutual authentication is performed at the computer level, not the user level, thecomputer allowed by the firewall to access the TOE via EWS, OXPd, WS-*, and SNMP must itself bethe Administrative Computer. This means that non-TOE administrative users should not be allowedto logon to the Administrative Computer because every user of the Administrative Computer ispotentially a TOE administrator.IPsec is configured to use X.509v3 certificates via the Internet Key Exchange (IKE) protocols IKEv1and IKEv2 in the evaluated configuration.In addition, the TOE can contact many types of trusted IT products using IPsec and mutualauthentication over the interfaces specified in section 1.5.4.1. The TOE contacts these computerseither to send data to them (e.g., send email notification to the SMTP Gateway) or to requestinformation from them (e.g., authenticate a user using LDAP). The TOE mutually authenticatesthese servers via IPsec prior to sending data to them.






1.5.2.4 Data protection and access control

1.5.2.4.1 Permission SetsEach Control Panel application requires one or more permissions in order to execute it. Thesepermissions are defined in Permission Sets (a.k.a. Control Panel User Roles). The applied PermissionSet can be a combination of various Permission Sets associated with a user. The default PermissionSets in the evaluated configuration are:

● Device Administrator (assigned to U.ADMINISTRATOR)● Device User (assigned to U.NORMAL)

The TOE includes a Device Guest Permission Set, but it has no enabled permissions in the evaluatedconfiguration. Additional (custom) Permission Sets can be created and applied by the administratorin the evaluated configuration.The Device Administrator Permission Set has more permissions enabled than the Device UserPermission Set. This translates into U.ADMINISTRATORS users being able to accessmore functionality,specifically administrative functionality, than U.NORMAL users.Permission Set data is stored in the TOE and managed via EWS and WS-* Web Services.

1.5.2.4.2 Job PINsUsers control access to print jobs that they place on the TOE by assigning Job PINs to these jobs(required in the evaluated configuration). Job PINs must be 4 digits in length. Job PINs limit accessto these jobs while they reside on the TOE and allow users to control when the jobs are printed sothat physical access to the hard copies can be controlled.

1.5.2.4.3 Job Encryption PasswordThe TOE can store and decrypt encrypted stored print jobs received from a client computer whichhas the HP Universal Print Driver installed. A stored print job is first encrypted by the client computerusing a user-specified Job Encryption Password. The job is then sent encrypted to the TOE andstored encrypted by the TOE. To decrypt the job, a Control Panel user must enter the correct JobEncryption Password used to encrypt the job.

1.5.2.4.4 Common access controlThe TOE protects each print job in Job Storage from non-administrative users through the use of auser identifier and a Job PIN or through the use of just a Job Encryption Password. The user identifierfor a print job received from a client computer is either automatically assigned by that clientcomputer or assigned by the user sending the print job from the client computer. Every print jobin Job Storage is assigned either a Job PIN or a Job Encryption Password by the user at job creationtime.The default rules for a non-administrative (U.NORMAL) user for accessing a print job in Job Storageare:

● if the job is Job PIN protected:❍ the job owner (i.e., the authenticated user who matches the job's user identifier)

can access the job without supplying the Job PIN❍ any non-owner authenticated user who supplies the correct Job PIN can access

the job






● if the job is Job Encryption Password protected, any authenticated user who supplies thecorrect Job Encryption Password can access the job

A Control Panel administrator (U.ADMINISTRATOR) user has a permission in their Permission Setthat allows the administrator to delete a print job in Job Storage.

1.5.2.4.5 TOE function access controlFor Control Panel users, the TOE controls access to Control Panel applications (e.g., Print) usingPermission Sets and, optionally, sign-in methods (authentication databases). Permission Sets actas User Roles to determine if the user can perform a function controlled by permissions.Each Control Panel application requires the user to have one or more specific permissions in theirsession Permission Set in order to access that application. In addition, the TOE's administrator canmap sign in methods to each Control Panel application and require the user to be authenticated tothat sign in method in order to access that application. The individual applications only check andenforce permissions. They do not check the sign in methods. Instead, the TOE enforces the sign inmethod requirement at the time that the user signs in to the TOE by removing permissions fromthe user's session Permission Set for each application in which the user's sign in method does notmatch the sign in method required by the TOE. By removing the permissions required by eachnon-matching application, the TOE limits the set of applications that the user can access.Administrators can change/modify the sign in method mapped to each application. In addition, theTOE contains a checkbox that allows administrators to select if the sign in method applicationmappings are enforced or ignored by the TOE. This checkbox is called "Allow users to choosealternate sign-in methods." When this checkbox is disabled, the TOE enforces the "sign in methodto application" mappings and prunes (reduces) the user's session Permission Set accordingly. Whenthis checkbox is enabled, the sign in method mappings are ignored by the TOE and the user'ssession Permission Set remains unchanged.For IPsec users, the TOE uses the IPsec/Firewall to control access to the supported network protocols.The IPsec/Firewall contains the IP addresses of authorized client computers grouped into addresstemplates and the network service protocols grouped into service templates. The administratormaps an address template to a service template using an IPsec/Firewall rule. Service templates,therefore, act as the User Roles. IP addresses of computers not contained in a rule are deniedaccess to the TOE.

1.5.2.4.6 Residual information protectionThe TOE protects deleted objects by making them unavailable to TOE users via the TOE's interfaces.This prevents TOE users from attempting to recover deleted objects of other users via the TOEinterfaces.

1.5.2.5 Protection of the TSF

1.5.2.5.1 Restricted forwarding of data to external interfacesThe TOE disallows the forwarding of data received from an External Interface to the Shared-mediumInterface.

1.5.2.5.2 TSF self-testingThe TOE contains a suite of self tests to test specific security functionality of the TOE. It containsdata integrity checks for testing specific TSF Data of the TOE and for testing the stored TOEexecutables.






1.5.2.5.3 Reliable timestampsThe TOE contains a system clock that is used to generate reliable timestamps. In the evaluatedconfiguration, the TOE synchronizes the system clock with a Network Time Protocol (NTP) server.

1.5.2.6 TOE access protection

1.5.2.6.1 Inactivity timeoutThe Control Panel supports an administrator selectable inactivity timeout in case users forget tologout of the Control Panel after logging in.

1.5.2.7 Trusted channel communication and certificate managementThe TOE supports IPsec to protect data being transferred over the Shared-medium Interface. IPsecuses IP addresses and X.509v3 certificates to identify and authenticate the Network Client Computersand Administrative Computers as well as other trusted IT products to which the TOE connects (e.g.,syslog server, NTP server, SMTP gateway).The TOE uses several cryptographic algorithms with IPsec. These cryptographic algorithms, suppliedby the QuickSec cryptographic library, are all part of the Operational Environment., but the TOEcontrols the usage of these algorithms. Also, the TOE uses a software-based random numbergenerator in the Operational Environment when creating symmetric encryption keys used ascommunications session keys and secret keys used during data integrity verification.In addition, the TOE provides certificate management functions used to manage (add, replace,delete) X.509v3 certificates.

1.5.2.8 User and access managementThe TOE provides management capabilities for managing its security functionality. The TOE supportsthe following roles:

● administrators (U.ADMINISTRATOR)● users (U.NORMAL)

Administrators have the authority to manage the security functionality of the TOE and to manageusers. Users can only manage user data that they have access to on the TOE.

1.5.3 TOE boundaries

1.5.3.1 PhysicalThe physical boundary of the TOE is the programs and data stored in the firmware of the HCD(except for the embedded operating system and the QuickSec cryptographic library) and theEnglish-language guidance documentation.It is typical for an HCD, and thus the TOE, to be shared by many users and for those users havedirect physical access to the HCD. By design, users have easy access to some of the hardwarefeatures, such as the Control Panel, the paper bins, the printer output trays, and the power switch.But other features such as the processor, firmware, and storage drive have more restricted access.These more restricted components (such as the processor board) are more difficult to accessbecause they require hardware tools to disassemble the HCD or have a combination lock used torestrict access (such as to restrict access to the storage drive).






Because of the restricted access to the storage drive, the drive is considered a non-removablenonvolatile storage device from the perspective of [PP2600.2].Due to the physical accessibility of the HCDs, they must be used in non-hostile environments.Physical access should be controlled and/or monitored.QuickSec version 5.1 ([QuickSec51]) library implements the TOE's IPsec including the IPsec/Firewall.QuickSec includes a cryptographic library. Although the IPsec implementation in QuickSec is in theTOE boundary, the QuickSec cryptographic library used by QuickSec for all IPsec cryptography ispart of the Operational Environment. QuickSec is developed and tested by SafeNet, Inc.Regarding the SMTP gateway, the TOE only provides protection from the TOE to the SMTP gateway.After that point, the Operational Environment must provide the remaining protection necessary totransfer the email from the SMTP gateway to the email's addressee(s).

1.5.3.2 LogicalThe security functionality provided by the TOE has been described above and includes:

● Auditing● Cryptography● Identification and authentication● Data protection and access control● Protection of the TSF (restricted forwarding, TSF self-testing, timestamps)● TOE access protection (inactivity timeout)● Trusted channel communication and certificate management● User and access management

1.5.3.3 Evaluated configurationThe following items will need to be adhered to in the evaluated configuration:

● HP High Performance Secure Hard Disk, if installed, must be configured with a passwordto activate drive encryption

● Device Administrator Password must be set● Only one Administrative Computer is used to manage the TOE● HP and third party applications cannot be installed on the TOE● All print jobs must be assigned a Job PIN or encrypted with a password● Type A and B USB ports must be disabled● Remote Firmware Upgrade through any means other than EWS (e.g., PJL) and USB must

be disabled● Jetdirect Inside management via telnet and FTP must be disabled● Jetdirect XML Services must be disabled● File System External Access must be disabled● IPsec authentication using X.509v3 certificates must be enabled (IPsec authentication using

Kerberos or Pre-Shared Key is not supported)● IPsec Authenticated Headers (AH) must be disabled● IPsec IKE Main Mode for key exchange must be used● Full Authentication must be enabled (this disables the Guest account)






● SNMP support limited to:❍ SNMPv1 read-only❍ SNMPv2c read-only❍ SNMPv3

● The Service PIN, used by a customer support engineer to access functions available to HPsupport personnel, must be disabled

● Near Field Communication (NFC) must be disabled● Wireless Direct Print must be disabled● PJL device access commands must be disabled● When using Windows Sign In, the Windows domain must reject Microsoft NT LAN Manager

(NTLM) connections● Display Names for the Local Device Sign In method users and user names for the LDAP

and Windows Sign In method users must only contain the characters defined inP.USERNAME.CHARACTER_SET.

1.5.4 Security policy modelThis section describes the security policy model for the TOE. Much of the terminology in this sectioncomes from [PP2600.2] and is duplicated here so that readers won't have to read [PP2600.2] tounderstand the terminology used in the rest of this Security Target document.

1.5.4.1 Subjects/UsersUsers are entities that are external to the TOE and which interact with the TOE. TOE users aredefined in Table 3.

DefinitionDesignation

Any authorized User. Authorized Users are U.ADMINISTRATOR and U.NORMAL.U.USER


A User who is authorized to perform User Document Data processingfunctions of the TOE.

U.NORMAL

A User who has been specifically granted the authority to manage someportion or all of the TOE and whose actions may affect the TOE securitypolicy (TSP). A passwordmust be set for all U.ADMINISTRATOR accountsin the evaluated configuration.

U.ADMINISTRATOR

Table 3: Users

For the purpose of clarity in this Security Target, the following distinctions are made:● Control Panel users – U.NORMAL and U.ADMINISTRATOR users who physically access

the TOE's Control Panel.❍ Security attributes: User Role (defined by Permission Set) and User Identifier

● IPsec users:






Network Client Computers – Computers (U.NORMAL entities) that cansuccessfully authenticate to the TOE's PJL Interface (TCP port 9100) using IPsecand mutual authentication. The TOE will accept print jobs from any user of a clientcomputer where the client computer has successfully authenticated with the TOE.

❍

➤ Security attributes: User Role (defined by IPsec/Firewall servicetemplate) and User Identifier (define by IP address)

❍ Administrative Computers – Computers (U.ADMINISTRATOR entities) that cansuccessfully authenticate to the TOE's administrative interfaces (e.g., EWS/HTTP,OXPd, WS-*, SNMP) using IPsec and mutual authentication. An AdministrativeComputer may also connect to the TOE as a Network Client Computer (i.e., theAdministrative Computer can send print jobs as a U.NORMAL user through the PJLInterface on port 9100).

➤ Security attributes: User Role (defined by IPsec/Firewall servicetemplate) and User Identifier (define by IP address)

1.5.4.2 ObjectsObjects are passive entities in the TOE that contain or receive information, and upon which Subjectsperform Operations. Objects are equivalent to TOE Assets. There are three types of Objects:

● User Data● TSF Data● Functions

1.5.4.2.1 User DataUser Data are data created by and for Users and do not affect the operation of the TOE SecurityFunctionality (TSF). This type of data is comprised of two objects:

● User Document Data● User Function Data


User Document Data consists of the information contained in a user's document. Thisincludes the original document itself in hardcopy or electronic form, image data, orresidually-stored data created by the HCD while processing an original document andprinted hardcopy output.

D.DOC

User Function Data are the information about a user's document or job to be processed bythe TOE.

D.FUNC

Table 4: User Data

User Data objects include:● Print job types that use Job Storage:

❍ Personal jobs – Print jobs from a client computer that are stored in Job Storage.In the evaluated configuration, such jobs must be PIN protected with a Job PIN.These jobs are held until the user logs in to the Control Panel and releases the job.For PIN protected stored jobs, the user must be the job owner or know the Job PIN






(or have administrator privileges) in order to delete the job. These jobs areautomatically deleted after printing or if the HCD is turned off (configurable by theadministrator) or after an administrator specified time interval.

❍ Stored jobs – Print jobs such as a personnel form, time sheet, or calendar froma client computer that are stored indefinitely on the TOE and reprinted. In theevaluated configuration, such jobs must be PIN protected with a Job PIN. For PINprotected stored jobs, the user must be the job owner or know the Job PIN (or haveadministrator privileges) in order to delete the job. On models containing an SSD,these jobs are automatically deleted when the HCD is power-cycled.

❍ Encrypted stored print jobs – Print jobs like those described above but thatrequire higher than normal protection (for example, documents containing companyor employee confidential information). These jobs will be assigned a password bythe submitter when submitted to the TOE. The user must know the password ofthe job in order to print or delete it. The administrator may delete it without knowingthe password. On models containing an SSD, these jobs are automatically deletedwhen the HCD is power-cycled.

Ownership of a print job sent from a client computer is defined as the username associated withthe job when it is submitted to the TOE. The username is specified outside of the TOE, in theOperational Environment, so it can neither be confirmed nor denied by the TOE.

1.5.4.2.2 TSF DataTSF Data are data created by and for the TOE and that might affect the operation of the TOE. Thistype of data is comprised of two components: TSF Protected Data and TSF Confidential Data.


TSF Confidential Data are assets for which either disclosure or alteration by a user who isneither an administrator nor the owner of the data would have an effect on the operationalsecurity of the TOE.

D.CONF

TSF Protected Data are assets for which alteration by a user who is neither an administratornor the owner of the data would have an effect on the operational security of the TOE, butfor which disclosure is acceptable.

D.PROT

Table 5: TSF Data

The following table lists the TSF Data and the data designations.

D.PROTD.CONFTSF Data

XAudit records

XCryptographic keys and certificates

XDevice and network configuration settings (including IPsec/Firewall rules andtemplates)

XJob data including Job PINs

XPJL protocol excluding the job data and Job PINs






D.PROTD.CONFTSF Data

XPermission Sets

XSystem time

XUser and Administrator identification data

XUser and Administrator authentication data

Table 6: TSF Data Listing

1.5.4.3 SFR package functionsFunctions perform processing, storage, and transmission of data. The following [PP2600.2]-definedfunctions apply to this Security Target.


Document storage and retrieval: a function in which a document is stored during one joband retrieved during one or more subsequent jobs

F.DSR

Printing: a function in which electronic document input is converted to physical documentoutput

F.PRT

Shared-medium interface: a function that transmits or receives User Data or TSF Data overa communications medium which, in conventional practice, is or can be simultaneouslyaccessed bymultiple users, such as wired network media andmost radio-frequency wirelessmedia

F.SMI

Table 7: SFR package functions

1.5.4.4 SFR package attributesWhen a function is performing processing, storage, or transmission of data, the identity of thefunction is associated with that particular data as a security attribute. The following[PP2600.2]-defined attributes apply to this Security Target.


Indicates data that is associated with a document storage and retrieval job.+DSR

Indicates data that is associated with a print job.+PRT

Indicates data that is transmitted or received over a shared-medium interface.+SMI

Table 8: SFR package attributes






2 CC Conformance ClaimThis Security Target is CC Part 2 extended and CC Part 3 conformant, with a claimed EvaluationAssurance Level of EAL2, augmented by ALC_FLR.2.This Security Target claims conformance to the following Protection Profiles and PP packages, ifany:

● [PP2600.2]: IEEE Std 2600.2-2009; "2600.2-PP, Protection Profile for Hardcopy Devices,Operational Environment B" (with NIAP CCEVS Policy Letter #20) . Version 1.0 as ofDecember 2009; demonstrable conformance.

● [PP2600.2-DSR]: SFR Package for Hardcopy Device Document Storage and Retrieval (DSR)Functions. Version 1.0 as of December 2009; demonstrable conformance.

● [PP2600.2-PRT]: SFR Package for Hardcopy Device Print Functions. Version 1.0 as ofDecember 2009; demonstrable conformance.

● [PP2600.2-SMI]: SFR Package for Hardcopy Device Shared-medium Interface Functions.Version 1.0 as of December 2009; demonstrable conformance.

Common Criteria [CC] version 3.1 revision 4 is the basis for this conformance claim.

2.1 Protection Profile tailoring and additions

2.1.1 IEEE Std 2600.2-2009; "2600.2-PP, Protection Profile forHardcopy Devices, Operational Environment B" (with NIAP CCEVSPolicy Letter #20) ([PP2600.2])In this Security Target, [PP2600.2] has been modified to conform with the NIAP CCEVS Policy Letter#20 ([CCEVS-PL20]).Although the HCDs in this Security Target contain a nonvolatile storage device (i.e., a storage drive),this device is considered an internal, built-in component of the HCDs and, therefore, constitutes anon-removable nonvolatile storage device from the perspective of [PP2600.2] and [CCEVS-PL20].Because no removable nonvolatile storage devices exist in the HCDs, this Security Target does notclaim conformance to "2600.2-NVS SFR Package for Hardcopy Device Nonvolatile Storage Functions,Operational Environment B" contained in [PP2600.2].The following tables provide the mappings of and rationale for how the SFRs in this Security Targetmap to the SFRs in the protection profile [PP2600.2]. The term "n/a" means "not applicable". Theterm "common" is used to refer to that portion of [PP2600.2] to which all TOEs must conform (i.e.,the portions not labeled as packages).

RationaleHierarchicalsubstitution

IterationMaps to ST SFR(s)[PP2600.2] SFR

The ST's FAU_GEN.1 combines thecontents of FAU_GEN.1 from thecommon [PP2600.2] and FAU_GEN.1from the [PP2600.2] SMI SFRpackage.

FAU_GEN.1FAU_GEN.1

n/aFAU_GEN.2FAU_GEN.2








The ST's FDP_ACC.1-cac combinesthe contents of the FDP_ACC.1(a)from the common [PP2600.2] and

FDP_ACC.1-cacFDP_ACC.1(a)

the FDP_ACC.1's from the[PP2600.2] packages claimed bythe ST. The iteration name waschanged from "(a)" to "-cac"(Common Access Control) for betterunderstandability when reading theST.

The iteration name was changedfrom "(b)" to "-tfac" (TOE FunctionAccess Control) for betterunderstandability when reading theST.

FDP_ACC.1-tfacFDP_ACC.1(b)

The ST's FDP_ACF.1-cac combinesthe contents of the FDP_ACF.1(a)from the common [PP2600.2] and

FDP_ACF.1-cacFDP_ACF.1(a)

the FDP_ACF.1's from the[PP2600.2] packages claimed bythe ST. The iteration name waschanged from "(a)" to "-cac"(Common Access Control) for betterunderstandability when reading theST.

The iteration name was changedfrom "(b)" to "-tfac" (TOE FunctionAccess Control) for betterunderstandability when reading theST.

FDP_ACF.1-tfacFDP_ACF.1(b)

n/aFDP_RIP.1FDP_RIP.1

n/aFIA_ATD.1FIA_ATD.1

The TOE's Control Panel supportsauthentication (FIA_UAU.1).

FIA_UAU.1FIA_UAU.1

The TOE supports IPsecauthentication (FIA_UAU.2) whichcomplies with the more restrictiveFIA_UAU.2.

XFIA_UAU.2

The TOE's Control Panel supportsidentification (FIA_UID.1).

FIA_UID.1FIA_UID.1








The TOE supports IPsecidentification (FIA_UID.2) whichcomplies with the more restrictiveFIA_UID.2.

XFIA_UID.2

n/aFIA_USB.1FIA_USB.1

FMT_MSA.1(a) iteration name isdifferent to better reflect thesecurity attributes involved becausethis SFR is shared with anotheraccess control policy.

XFMT_MSA.1-permFMT_MSA.1(a)

FMT_MSA.1(b) was further iteratedbecause the operations on thesecurity attributes differ.

XFMT_MSA.1-perm andFMT_MSA.1-tfac

FMT_MSA.1(b)

FMT_MSA.3(a) was omitted becausethe security attributes do not havedefault values in the evaluatedconfiguration.

NoneFMT_MSA.3(a)

FMT_MSA.3(b) was omitted becausethe security attributes do not havedefault values in the evaluatedconfiguration.

NoneFMT_MSA.3(b)

The iteration name was changedfrom "(a)" to "-auth" (TSF Dataassociated with authorization) forbetter understandability whenreading the ST.

FMT_MTD.1-authFMT_MTD.1.1(a)

The iteration name was changedfrom "(b)" to "-users" (TSF Dataassociated with users) for betterunderstandability when reading theST.

FMT_MTD.1-usersFMT_MTD.1.1(b)

n/aFMT_SMF.1FMT_SMF.1

n/aFMT_SMR.1FMT_SMR.1

Because the TOE is configured touse NTP along with its internal timesource, both A.SERVICES.RELIABLEand OE.SERVICES.RELIABLE apply.

FPT_STM.1FPT_STM.1

n/aFPT_TST.1FPT_TST.1








n/aFTA_SSL.3FTA_SSL.3

Table 9: SFR mappings between 2600.2 and the ST

These SFRs in the Security Target are not required by and do not map to the protection profile[PP2600.2].



FCS_CKM.1 specifies the types ofcryptographic keys generated bythe TOE for use with AES and HMACin IPsec.

FCS_CKM.1None

FCS_CKM.2 specifies thecryptographic key distributionmethods used by the TOE in IKEv1and IKEv2 in IPsec.

FCS_CKM.2None

FCS_COP.1-ipsec specifies the AESencryption and decryptionalgorithm, the RSA decryptionalgorithm, and the HMAC algorithmsused by the TOE in IPsec.

XFCS_COP.1-ipsecNone

FCS_COP.1-job specifies the AESdecryption algorithm used by theTOE for decrypting encrypted printjobs.

XFCS_COP.1-jobNone

FIA_SOS.1 specifies the Job PINstrength of certain authorizationmechanisms used by the TOE.

FIA_SOS.1None

The TOE masks Job PINs, AccessCodes, and passwords.Recommended by [PP2600.2]APPLICATION NOTE 38.

FIA_UAU.7None

The TOE allows administrators toallow or disallow users fromchoosing an alternate sign inmethod differing from theadministrator-selected method.

XFMT_MOF.1None

Table 10: SFR mappings of non-PP2600.2 SFRs and the ST (in the ST, but not requiredby or hierarchical to SFRs in PP2600.2)






2.1.2 SFR Package for Hardcopy Device Document Storage andRetrieval (DSR) Functions ([PP2600.2-DSR])The following table shows how the SFRs in this SFR package map to the SFRs in the Security Target.


IterationMaps to ST SFR(s)[PP2600.2-DSR]SFR

See rationale for FDP_ACC.1(a).XFDP_ACC.1-cacFDP_ACC.1

See rationale for FDP_ACF.1(a).XFDP_ACF.1-cacFDP_ACF.1

Table 11: SFR mappings between 2600.2-DSR and the ST

2.1.3 SFR Package for Hardcopy Device Print Functions([PP2600.2-PRT])The following table shows how the SFRs in this SFR package map to the SFRs in the Security Target.


IterationMaps to ST SFR(s)[PP2600.2-PRT]SFR

See rationale for FDP_ACC.1(a).XFDP_ACC.1-cacFDP_ACC.1

See rationale for FDP_ACF.1(a).XFDP_ACF.1-cacFDP_ACF.1

Table 12: SFR mappings between 2600.2-PRT and the ST

2.1.4 SFR Package for Hardcopy Device Shared-medium InterfaceFunctions ([PP2600.2-SMI])The following table shows how the SFRs in this SFR package map to the SFRs in the Security Target.


IterationMaps to ST SFR(s)[PP2600.2-SMI]SFR

The ST's FAU_GEN.1 combines thecontents of FAU_GEN.1 from thecommon [PP2600.2] and FAU_GEN.1from the [PP2600.2] SMI SFRpackage.

FAU_GEN.1FAU_GEN.1

n/aFPT_FDI_EXP.1FPT_FDI_EXP.1

[CCEVS-PL20] modifies FTP_ITC.1.3.FTP_ITC.1FTP_ITC.1

Table 13: SFR mappings between 2600.2-SMI and the ST






3 Security Problem Definition

3.1 IntroductionThe statement of TOE security environment describes the security aspects of the environment inwhich the TOE is intended to be used and the manner in which it is expected to be deployed.To this end, the statement of TOE security environment identifies the list of assumptions made onthe Operational Environment (including physical and procedural measures) and the intendedmethodof use of the product, defines the threats that the product is designed to counter, and theorganizational security policies with which the product is designed to comply.

3.2 Threat EnvironmentThis security problem definition addresses threats posed by four categories of threat agents:

a) Persons who are not permitted to use the TOE who may attempt to use the TOEb) Persons who are authorized to use the TOE who may attempt to use TOE functions for

which they are not authorized.c) Persons who are authorized to use the TOE who may attempt to access data in ways for

which they not authorized.d) Persons who unintentionally cause a software malfunction that may expose the TOE to

unanticipated threats.The threats and policies defined in this Security Target address the threats posed by these threatagents.The threat agents are assumed to originate from a well managed user community in a non-hostileworking environment. Therefore, the product protects against threats of security vulnerabilitiesthat might be exploited in the intended environment for the TOE with low level of expertise andeffort. The TOE protects against straightforward or intentional breach of TOE security by attackerspossessing a Basic attack potential.

3.2.1 Threats countered by the TOET.DOC.DIS

User Document Data may be disclosed to unauthorized persons.

T.DOC.ALTUser Document Data may be altered by unauthorized persons.

T.FUNC.ALTUser Function Data may be altered by unauthorized persons.

T.PROT.ALTTSF Protected Data may be altered by unauthorized persons.

T.CONF.DISTSF Confidential Data may be disclosed to unauthorized persons.






T.CONF.ALTTSF Confidential Data may be altered by unauthorized persons.

3.3 Assumptions

3.3.1 Environment of use of the TOE

3.3.1.1 PhysicalA.ACCESS.MANAGED

The TOE is located in a restricted or monitored environment that provides protection fromunmanaged access to the physical components and data interfaces of the TOE.

A.ADMIN.PC.SECUREThe administrative computer is in a physically secured and managed environment and onlythe authorized administrator has access to it.

A.USER.PC.POLICYUser computers are configured and used in conformance with the organization's securitypolicies.

3.3.1.2 PersonnelA.USER.TRAINING

TOE Users are aware of the security policies and procedures of their organization, and aretrained and competent to follow those policies and procedures.

A.ADMIN.TRAININGAdministrators are aware of the security policies and procedures of their organization, aretrained and competent to follow the manufacturer's guidance and documentation, andcorrectly configure and operate the TOE in accordance with those policies and procedures.

A.ADMIN.TRUSTAdministrators do not use their privileged access rights for malicious purposes.

3.3.1.3 ConnectivityA.SERVICES.RELIABLE

When the TOE uses any of the network services CIFS, DNS, Kerberos, LDAP, NTP, SMTP,syslog, and/or WINS, these services provide reliable information and responses to the TOE.






3.4 Organizational Security Policies

3.4.1 Included in the PP2600.2 protection profileP.USER.AUTHORIZATION

To preserve operational accountability and security, Users will be authorized to use the TOEonly as permitted by the TOE Owner.

P.SOFTWARE.VERIFICATIONTo detect corruption of the executable code in the TSF, procedures will exist to self-verifyexecutable code in the TSF.

P.AUDIT.LOGGINGTo preserve operational accountability and security, records that provide an audit trail ofTOE use and security-relevant events will be created, maintained, and protected fromunauthorized disclosure or alteration, and will be reviewed by authorized personnel.

P.INTERFACE.MANAGEMENTTo prevent unauthorized use of the external interfaces of the TOE, operation of thoseinterfaces will be controlled by the TOE and its IT environment.

3.4.2 In addition to the PP2600.2 protection profileP.ADMIN.PASSWORD

To restrict access to administrative tasks, the Device Administrator Password will be set inthe evaluated configuration so that it is required to perform security-relevant actions throughEWS (HTTP) or at the Control Panel.

P.USERNAME.CHARACTER_SETTo prevent ambiguous user names in the TOE's audit trail, the Display Names of the LocalDevice Sign In method users and the user names of the LDAP and Windows Sign In methodusers must only contain ASCII printable characters except for the double quote (22 hex) andsingle quote (27 hex) characters (i.e., allowed ASCII characters in hexadecimal: 20, 21, 23- 26, 28 - 7E).






4 Security Objectives

4.1 Objectives for the TOEO.AUDIT.LOGGED

The TOE shall create andmaintain a log of TOE use and security-relevant events, and preventits unauthorized disclosure or alteration.

O.CONF.NO_ALTThe TOE shall protect TSF Confidential Data from unauthorized alteration.

O.CONF.NO_DISThe TOE shall protect TSF Confidential Data from unauthorized disclosure.

O.DOC.NO_ALTThe TOE shall protect User Document Data from unauthorized alteration.

O.DOC.NO_DISThe TOE shall protect User Document Data from unauthorized disclosure.

O.FUNC.NO_ALTThe TOE shall protect User Function Data from unauthorized alteration.

O.INTERFACE.MANAGEDThe TOE shall manage the operation of external interfaces in accordance with securitypolicies.

O.PROT.NO_ALTThe TOE shall protect TSF Protected Data from unauthorized alteration.

O.SOFTWARE.VERIFIEDThe TOE shall provide procedures to self-verify executable code in the TSF.

O.USER.AUTHORIZEDThe TOE shall require identification and authentication of Users, and shall ensure that Usersare authorized in accordance with security policies before allowing them to use the TOE.

4.2 Objectives for the Operational EnvironmentOE.ADMIN.PC.SECURE

The TOE Owner shall locate the Administrative Computer in a physically secured andmanagedenvironment and allow only authorized personnel access to it.






OE.ADMIN.TRAINEDThe TOE Owner shall ensure that TOE Administrators are aware of the security policies andprocedures of their organization; have the training, competence, and time to follow themanufacturer's guidance and documentation; and correctly configure and operate the TOEin accordance with those policies and procedures.

OE.ADMIN.TRUSTEDThe TOE Owner shall establish trust that TOE Administrators will not use their privilegedaccess rights for malicious purposes.

OE.AUDIT.REVIEWEDThe TOE Owner shall ensure that audit logs are reviewed at appropriate intervals for securityviolations or unusual patterns of activity.

OE.AUDIT_ACCESS.AUTHORIZEDIf audit records generated by the TOE are exported from the TOE to another trusted ITproduct, the TOE Owner shall ensure that those records can be accessed in order to detectpotential security violations, and only by authorized persons.

OE.AUDIT_STORAGE.PROTECTEDIf audit records are exported from the TOE to another trusted IT product, the TOE Ownershall ensure that those records are protected from unauthorized access, deletion andmodifications.

OE.INTERFACE.MANAGEDThe IT environment shall provide protection from unmanaged access to TOE externalinterfaces.

OE.PHYSICAL.MANAGEDThe TOE shall be placed in a secure or monitored area that provides protection fromunmanaged physical access to the TOE.

OE.SERVICES.RELIABLEWhen the TOE uses any of the network services CIFS, DNS, Kerberos, LDAP, NTP, SMTP,syslog, and/or WINS, these services shall provide reliable information and responses to theTOE.

OE.USER.AUTHORIZEDThe TOE Owner shall grant permission to Users to be authorized to use the TOE accordingto the security policies and procedures of their organization.

OE.USER.PC.POLICYThe TOE Owner shall create a set of security policies to which user computers will conform.






OE.USER.TRAINEDThe TOE Owner shall ensure that Users are aware of the security policies and proceduresof their organization, and have the training and competence to follow those policies andprocedures.

OE.USERNAME.CHARACTER_SETThe Display Names of all Local Device Sign In method users and the user names of all LDAPand Windows Sign In method users shall only contain ASCII printable characters except forthe double quote (22 hex) and single quote (27 hex) characters (i.e., allowed ASCII charactersin hexadecimal: 20, 21, 23 - 26, 28 - 7E).

4.3 Security Objectives Rationale

4.3.1 CoverageThe following table provides a mapping of TOE objectives to threats and policies, showing that eachobjective counters or enforces at least one threat or policy, respectively.

Threats / OSPsObjective

P.AUDIT.LOGGINGO.AUDIT.LOGGED

T.CONF.ALTO.CONF.NO_ALT

T.CONF.DISO.CONF.NO_DIS

T.DOC.ALTO.DOC.NO_ALT

T.DOC.DISO.DOC.NO_DIS

T.FUNC.ALTO.FUNC.NO_ALT

P.INTERFACE.MANAGEMENTO.INTERFACE.MANAGED

T.PROT.ALTO.PROT.NO_ALT

P.SOFTWARE.VERIFICATIONO.SOFTWARE.VERIFIED

T.DOC.DIST.DOC.ALTT.FUNC.ALTT.PROT.ALTT.CONF.DIST.CONF.ALTP.USER.AUTHORIZATION

O.USER.AUTHORIZED

Table 14: Mapping of security objectives to threats and policies

The following table provides a mapping of the objectives for the Operational Environment toassumptions, threats and policies, showing that each objective holds, counters or enforces at leastone assumption, threat or policy, respectively.






Assumptions / Threats / OSPsObjective

A.ADMIN.PC.SECUREOE.ADMIN.PC.SECURE

A.ADMIN.TRAININGP.ADMIN.PASSWORD

OE.ADMIN.TRAINED

A.ADMIN.TRUSTOE.ADMIN.TRUSTED

P.AUDIT.LOGGINGOE.AUDIT.REVIEWED

P.AUDIT.LOGGINGOE.AUDIT_ACCESS.AUTHORIZED

P.AUDIT.LOGGINGOE.AUDIT_STORAGE.PROTECTED

P.INTERFACE.MANAGEMENTOE.INTERFACE.MANAGED

A.ACCESS.MANAGEDOE.PHYSICAL.MANAGED

A.SERVICES.RELIABLEOE.SERVICES.RELIABLE

T.DOC.DIST.DOC.ALTT.FUNC.ALTT.PROT.ALTT.CONF.DIST.CONF.ALTP.USER.AUTHORIZATION

OE.USER.AUTHORIZED

A.USER.PC.POLICYOE.USER.PC.POLICY

A.USER.TRAININGOE.USER.TRAINED

P.USERNAME.CHARACTER_SETOE.USERNAME.CHARACTER_SET

Table 15: Mapping of security objectives for the Operational Environment to assumptions,threats and policies

4.3.2 SufficiencyThe following rationale provides justification that the security objectives are suitable to countereach individual threat and that each security objective tracing back to a threat, when achieved,actually contributes to the removal, diminishing or mitigation of that threat:

Rationale for security objectivesThreat

The threat:T.DOC.DIS● User Document Data may be disclosed to unauthorized persons.

is countered by:● O.DOC.NO_DIS which protects D.DOC from unauthorized disclosure.● O.USER.AUTHORIZED which establishes user identification and

authentication as the basis for authorization.







● OE.USER.AUTHORIZED which establishes responsibility of the TOEOwner to appropriately grant authorization.

The threat:T.DOC.ALT● User Document Data may be altered by unauthorized persons.

is countered by:● O.DOC.NO_ALT which protects D.DOC from unauthorized alteration.● O.USER.AUTHORIZED which establishes user identification and

authentication as the basis for authorization.● OE.USER.AUTHORIZED which establishes responsibility of the TOE

Owner to appropriately grant authorization.

The threat:T.FUNC.ALT● User Function Data may be altered by unauthorized persons.

is countered by:● O.FUNC.NO_ALT which protects D.FUNC from unauthorized

alteration.● O.USER.AUTHORIZED which establishes user identification and



The threat:T.PROT.ALT● TSF Protected Data may be altered by unauthorized persons.

is countered by:● O.PROT.NO_ALT which protects D.PROT from unauthorized




The threat:T.CONF.DIS● TSF Confidential Data may be disclosed to unauthorized persons.

is countered by:● O.CONF.NO_DIS which protects D.CONF from unauthorized

disclosure.● O.USER.AUTHORIZED which establishes user identification and



The threat:T.CONF.ALT● TSF Confidential Data may be altered by unauthorized persons.







is countered by:● O.CONF.NO_ALT which protects D.CONF from unauthorized




Table 16: Sufficiency of objectives countering threats

The following rationale provides justification that the security objectives for the environment aresuitable to cover each individual assumption, that each security objective for the environment thattraces back to an assumption about the environment of use of the TOE, when achieved, actuallycontributes to the environment achieving consistency with the assumption, and that if all securityobjectives for the environment that trace back to an assumption are achieved, the intended usageis supported:

Rationale for security objectivesAssumption

The assumption:A.ACCESS.MANAGED● The TOE is located in a restricted or monitored environment that

provides protection from unmanaged access to the physicalcomponents and data interfaces of the TOE.

is upheld by:● OE.PHYSICAL.MANAGED which establishes a protected physical

environment for the TOE.

The assumption:A.ADMIN.PC.SECURE● The administrative computer is in a physically secured andmanaged

environment and only the authorized administrator has access toit.

is upheld by:● OE.ADMIN.PC.SECURE which establishes the responsibility of the

TOE owner to locate the administrative computer in a physicallysecured and managed environment and allow only authorizedpersonnel access.

The assumption:A.USER.PC.POLICY● User computers are configured and used in conformance with the

organization's security policies.

is upheld by:● OE.USER.PC.POLICY which establishes the responsibility of the TOE

owner to create a set of security policies to which user computerswill conform.

The assumption:A.USER.TRAINING






Rationale for security objectivesAssumption

● TOE Users are aware of the security policies and procedures oftheir organization, and are trained and competent to follow thosepolicies and procedures.

is upheld by:● OE.USER.TRAINEDwhich establishes responsibility of the TOE Owner

to provide appropriate User training.

The assumption:A.ADMIN.TRAINING● Administrators are aware of the security policies and procedures

of their organization, are trained and competent to follow themanufacturer's guidance and documentation, and correctlyconfigure and operate the TOE in accordance with those policiesand procedures.

is upheld by:● OE.ADMIN.TRAINED which establishes responsibility of the TOE

Owner to provide appropriate Administrator training.

The assumption:A.ADMIN.TRUST● Administrators do not use their privileged access rights for malicious

purposes.

is upheld by:● OE.ADMIN.TRUSTED which establishes responsibility of the TOE

Owner to have a trusted relationship with Administrators.

The assumption:A.SERVICES.RELIABLE● When the TOE uses any of the network services CIFS, DNS,

Kerberos, LDAP, NTP, SMTP, syslog, and/or WINS, these servicesprovide reliable information and responses to the TOE.

is upheld by:● OE.SERVICES.RELIABLE which, when the TOE uses the network

services CIFS, DNS, Kerberos, LDAP, NTP, SMTP, syslog, and/orWINS, establishes that these services provide reliable informationand responses to the TOE.

Table 17: Sufficiency of objectives holding assumptions

The following rationale provides justification that the security objectives are suitable to cover eachindividual organizational security policy, that each security objective that traces back to an OSP,when achieved, actually contributes to the implementation of the OSP, and that if all securityobjectives that trace back to an OSP are achieved, the OSP is implemented:

Rationale for security objectivesOSP

The OSP:P.USER.AUTHORIZATION● To preserve operational accountability and security, Users will be

authorized to use the TOE only as permitted by the TOE Owner.







is enforced by:● O.USER.AUTHORIZED which establishes user identification and

authentication as the basis for authorization to use the TOE.● OE.USER.AUTHORIZED which establishes responsibility of the TOE


The OSP:P.SOFTWARE.VERIFICATION● To detect corruption of the executable code in the TSF, procedures

will exist to self-verify executable code in the TSF.

is enforced by:● O.SOFTWARE.VERIFIED which provides procedures to self-verify

executable code in the TSF.

The OSP:P.AUDIT.LOGGING● To preserve operational accountability and security, records that

provide an audit trail of TOE use and security-relevant events willbe created, maintained, and protected from unauthorized disclosureor alteration, and will be reviewed by authorized personnel.

is enforced by:● O.AUDIT.LOGGED which creates and maintains a log of TOE use

and security-relevant events, and prevents unauthorized disclosureor alteration.

● OE.AUDIT_STORAGE.PROTECTED which protects exported auditrecords from unauthorized access, deletion and modifications.

● OE.AUDIT_ACCESS.AUTHORIZED which establishes responsibilityof, the TOE Owner to provide appropriate access to exported auditrecords.

● OE.AUDIT.REVIEWED which establishes responsibility of the TOEOwner to ensure that audit logs are appropriately reviewed.

The OSP:P.INTERFACE.MANAGEMENT● To prevent unauthorized use of the external interfaces of the TOE,

operation of those interfaces will be controlled by the TOE and itsIT environment.

is enforced by:● O.INTERFACE.MANAGED which manages the operation of external

interfaces in accordance with security policies.● OE.INTERFACE.MANAGED which establishes a protected

environment for TOE external interfaces.

The OSP:P.ADMIN.PASSWORD● To restrict access to administrative tasks, the Device Administrator

Password will be set in the evaluated configuration so that it isrequired to perform security-relevant actions through EWS (HTTP)or at the Control Panel.

is enforced by:







● OE.ADMIN.TRAINED which establishes responsibility of the TOEOwner to provide appropriate Administrator training.

The OSP:P.USERNAME.CHARACTER_SET● To prevent ambiguous user names in the TOE's audit trail, the

Display Names of the Local Device Sign In method users and theuser names of the LDAP and Windows Sign In method users mustonly contain ASCII printable characters except for the double quote(22 hex) and single quote (27 hex) characters (i.e., allowed ASCIIcharacters in hexadecimal: 20, 21, 23 - 26, 28 - 7E).

is enforced by:● OE.USERNAME.CHARACTER_SET which establishes that the Display

Names of all Local Device Sign In users and the user names of allLDAP and Windows Sign In methods users shall only contain ASCIIprintable characters except for the double quote (22 hex) and singlequote (27 hex) characters (i.e., allowed ASCII characters inhexadecimal: 20, 21, 23 - 26, 28 - 7E).

Table 18: Sufficiency of objectives enforcing Organizational Security Policies






5 Extended Components Definition[PP2600.2-SMI] defines the following extended component:

● FPT_FDI_EXP.1: Restricted forwarding of data to external interfaces

5.1 Class FPT: Protection of the TSFThis section describes the functional requirements for the restrictions of forwarding of data toexternal interfaces. This extended component is defined in [PP2600.2-SMI].

5.1.1 Restricted forwarding of data to external interfaces (FDI)Family behaviourThis family defines requirements for the TSF to restrict direct forwarding of information from oneexternal interface to another external interface.Many products receive information on specific external interfaces and are intended to transformand process this information before it is transmitted on another external interface. However, someproducts may provide the capability for attackers to misuse external interfaces to violate the securityof the TOE or devices that are connected to the TOE's external interfaces. Therefore, direct forwardingof unprocessed data between different external interfaces is forbidden unless explicitly allowed byan authorized administrative role. The family FPT_FDI_EXP has been defined to specify this kind offunctionality.

Component levellingFPT_FDI_EXP.1 Restricted forwarding of data to external interfaces provides for the functionality torequire TSF controlled processing of data received over defined external interfaces before thesedata are sent out on another external interface. Direct forwarding of data from one external interfaceto another one requires explicit allowance by an authorized administrative role.

Management: FPT_FDI_EXP.1There are no management activities foreseen.

Audit: FPT_FDI_EXP.1There are no audit events foreseen.

5.1.1.1 FPT_FDI_EXP.1 - Restricted forwarding of data to externalinterfaces

No other components.Hierarchical to:No dependencies.Dependencies:

The TSF shall provide the capability to restrict data received on[assignment: list of external interfaces] from being forwarded withoutfurther processing by the TSF to [assignment: list of external interfaces].

FPT_FDI_EXP.1.1






6 Security Requirements

6.1 TOE Security Functional RequirementsThe following table shows the security functional requirements for the TOE, and the operationsperformed on the components according to CC part 2: iteration (Iter.), refinement (Ref.), assignment(Ass.) and selection (Sel.).

OperationsSourceBasesecurityfunctionalcomponent

Security functional requirementSecurityfunctionalgroup Sel.Ass.Ref.Iter.

YesYesNoNoPP2600.2FAU_GEN.1 Audit data generationFAU - Securityaudit

NoNoNoNoPP2600.2FAU_GEN.2 User identity association

NoYesYesNoCC Part 2FCS_CKM.1 Cryptographic keygeneration

FCS -Cryptographicsupport

NoYesYesNoCC Part 2FCS_CKM.2 Cryptographic keydistribution

NoYesYesYesCC Part 2FCS_COP.1FCS_COP.1-ipsec Cryptographicoperation

NoYesNoYesCC Part 2FCS_COP.1FCS_COP.1-job Cryptographicoperation

NoYesNoYesPP2600.2FDP_ACC.1FDP_ACC.1-cac Common accesscontrol SFP

FDP - User dataprotection

NoYesNoYesPP2600.2FDP_ACC.1FDP_ACC.1-tfac TOE function accesscontrol SFP

NoYesNoYesPP2600.2FDP_ACF.1FDP_ACF.1-cac Common accesscontrol functions

NoYesNoYesPP2600.2FDP_ACF.1FDP_ACF.1-tfac TOE function accesscontrol functions

YesYesNoNoPP2600.2FDP_RIP.1 Subset residualinformation protection

NoYesNoNoPP2600.2FIA_ATD.1 Local user attributedefinition

FIA - Identificationandauthentication

NoYesNoNoCC Part 2FIA_SOS.1 Verification of secrets

NoYesYesNoPP2600.2FIA_UAU.1 Timing of Control Panelauthentication

NoNoYesNoPP2600.2FIA_UAU.2 IPsec authenticationbefore any action

NoYesYesNoCC Part 2FIA_UAU.7 Control Panel protectedauthentication feedback






OperationsSourceBasesecurityfunctionalcomponent

Security functional requirementSecurityfunctionalgroup Sel.Ass.Ref.Iter.

NoYesYesNoPP2600.2FIA_UID.1 Timing of Control Panelidentification

NoNoYesNoPP2600.2FIA_UID.2 IPsec identification beforeany action

NoYesYesNoPP2600.2FIA_USB.1 User-subject binding

YesYesNoNoCC Part 2FMT_MOF.1 Management ofauthentication security functionsbehavior

FMT - Securitymanagement

YesYesNoYesPP2600.2FMT_MSA.1FMT_MSA.1-perm Management ofPermission Set security attributes

YesYesNoYesPP2600.2FMT_MSA.1FMT_MSA.1-tfac Management ofTOE function security attributes

YesYesNoYesPP2600.2FMT_MTD.1FMT_MTD.1-auth Management ofTSF data

YesYesNoYesPP2600.2FMT_MTD.1FMT_MTD.1-users Management ofTSF data

NoYesNoNoPP2600.2FMT_SMF.1 Specification ofmanagement functions

NoYesNoNoPP2600.2FMT_SMR.1 Security roles

NoYesNoNoPP2600.2-SMI

FPT_FDI_EXP.1 Restricted forwardingof data to external interfaces

FPT - Protection ofthe TSF

NoNoNoNoPP2600.2FPT_STM.1 Reliable time stamps

YesYesNoNoPP2600.2FPT_TST.1 TSF testing

NoYesYesNoPP2600.2FTA_SSL.3 Control PanelTSF-initiated termination

FTA - TOE access

YesYesYesNoPP2600.2-SMI

FTP_ITC.1 Inter-TSF trusted channelFTP - Trustedpath/channels

Table 19: Security functional requirements for the TOE

6.1.1 Security audit (FAU)

6.1.1.1 Audit data generation (FAU_GEN.1)The TSF shall be able to generate an audit record of the following auditable events:FAU_GEN.1.1a) Start-up and shutdown of the audit functions; and






b) All auditable events for the not specified level of audit; andc) All Auditable Events as each is defined for its Audit Level (if one is

specified) for the Relevant SFR in Table 20; none.The TSF shall record within each audit record at least the following information:FAU_GEN.1.2a) Date and time of the event, type of event, subject identity (if applicable),

and the outcome (success or failure) of the event; andb) For each audit event type, based on the auditable event definitions of the

functional components included in the PP/ST, for each Relevant SFRlisted in Table 20: (1) information as defined by its Audit Level (ifone is specified), and (2) all Additional Information (if any isrequired); none.

[PP2600.2]Additionalinformation

Audit levelRelevantSFR(s)

Auditable event

Yes: CommonNone requiredBasicFIA_UAU.1,FIA_UAU.2

Both successful and unsuccessful use ofthe authentication mechanism

Yes: CommonAttempted useridentity, if available

BasicFIA_UID.1,FIA_UID.2

Both successful and unsuccessful use ofthe identification mechanism

Yes: CommonNone requiredMinimumFMT_SMF.1Use of the management functions

Yes: CommonNone requiredMinimumFMT_SMR.1Modifications to the group of users thatare part of a role

Yes: CommonNone requiredMinimumFPT_STM.1Changes to the time

Yes: SMINone requiredMinimumFTP_ITC.1Failure of the trusted channel functions

NoNone requiredMinimumFTA_SSL.3Termination of an interactive session bythe session termination mechanism

Table 20: Auditable events

6.1.1.2 User identity association (FAU_GEN.2)For audit events resulting from actions of identified users, the TSF shall be ableto associate each auditable event with the identity of the user that caused theevent.

FAU_GEN.2.1

6.1.2 Cryptographic support (FCS)

6.1.2.1 Cryptographic key generation (FCS_CKM.1)The QuickSec cryptographic library in the Operational Environment TSF shallgenerate cryptographic keys in accordance with a specified cryptographic keygeneration algorithm defined in Table 21 and specified cryptographic key sizesdefined in Table 21 that meet the following: the standards defined in Table21.

FCS_CKM.1.1






StandardsKey sizes(in bits)

Key generationalgorithm

Protocol

[RFC4301] Security Architecture for the InternetProtocol

128, 192, 256AESIPsec

[RFC2404] The Use of HMAC-SHA-1-96 within ESPand AH;[RFC4301] Security Architecture for the InternetProtocol;[RFC4894] Use of Hash Algorithms in Internet KeyExchange (IKE) and IPsec

96HMAC-SHA1-96

[RFC4868] Using HMAC-SHA-256, HMAC-SHA-384,and HMAC-SHA-512 with IPsec

256HMAC-SHA-256-128

384HMAC-SHA-384-196

512HMAC-SHA-512-256

Table 21: Cryptographic key generation

Application Note: Key generation for FCS_CKM.1 is implemented with the SSH random numbergenerator described in section 29.5.3 (pages 1044-1045) of [QuickSec51].

6.1.2.2 Cryptographic key distribution (FCS_CKM.2)The QuickSec cryptographic library in the Operational Environment TSF shalldistribute cryptographic keys in accordance with a specified cryptographic keydistribution method defined in Table 22 that meets the following: thestandards defined in Table 22.

FCS_CKM.2.1

StandardsKey distribution methodProtocol

[RFC2409] The Internet Key Exchange (IKE);[RFC4109] Algorithms for Internet Key Exchange version 1(IKEv1)

IKEv1IPsec

[RFC4306] Diffie-Hellman key agreement method defined forthe IKEv2 protocol;[RFC4718] IKEv2 Clarifications and Implementation Guidelines

IKEv2

Table 22: Cryptographic key distribution

6.1.2.3 Cryptographic operation (FCS_COP.1-ipsec)The QuickSec cryptographic library in the Operational Environment TSF shallperform the operations defined in Table 23 in accordance with a specifiedcryptographic algorithm defined in Table 23 and cryptographic key sizesdefined in Table 23 that meet the following: the standards defined in Table23.

FCS_COP.1.1







AlgorithmOperationsProtocol

[PKCS1v1.5] Public-Key CryptographyStandard (PKCS) #1: RSA EncryptionStandard

1024, 2048,4096

RSAAsymmetricdecryption

IPsec

[FIPS197] Advanced Encryption Standard;[SP800-38A] Recommendation for BlockCipher Modes of Operation: Methods andTechniques

128, 192, 256AES (CBC mode)Symmetricencryption anddecryption

[RFC2104] HMAC: Keyed-Hashing forMessage Authentication

96HMAC-SHA1-96Dataauthentication

[RFC4868] Using HMAC-SHA-256,HMAC-SHA-384, and HMAC-SHA-512 withIPsec

256HMAC-SHA-256-128

384HMAC-SHA-384-192

512HMAC-SHA-512-256

Table 23: Cryptographic operations

6.1.2.4 Cryptographic operation (FCS_COP.1-job)The TSF shall perform the operations defined in Table 24 in accordance witha specified cryptographic algorithm defined in Table 24 and cryptographic keysizes defined in Table 24 that meet the following: the standards defined inTable 24.

FCS_COP.1.1


AlgorithmOperationsProtocol

[FIPS197] Advanced Encryption Standard;[SP800-38A] Recommendation for BlockCipher Modes of Operation

256AES (CBC mode)Symmetricdecryption

Print job

Table 24: Cryptographic operations

6.1.3 User data protection (FDP)

6.1.3.1 Common access control SFP (FDP_ACC.1-cac)The TSF shall enforce the Common Access Control SFP in Table 25 on thelist of users as subjects, objects, and operations among subjects andobjects covered by the Common Access Control SFP in Table 25.

FDP_ACC.1.1






[PP2600.2]section

Access control rulesSubjectOperation(s)Object

CommonFor print jobs in Job Storage with the Job PINattribute set: From the Control Panel, subjectsmust be the job owner or know the Job PIN or

U.NORMALModify,Delete

D.FUNC

have the appropriate Job Storage permissionin their Permission Set to delete the job;otherwise, delete access is denied. D.FUNCfor Stored Jobs cannot be modified by anyuser, including U.ADMINISTRATOR.

For encrypted stored print jobs: From theControl Panel, subjects must know the job'sJob Encryption Password or have theappropriate Job Storage permission in theirPermission Set to delete D.FUNC; otherwise,delete access is denied.

CommonFor print jobs in Job Storage with the Job PINattribute set: From the Control Panel, subjectsmust be the job owner or know the Job PIN or

U.NORMALDeleteD.DOC

have the appropriate Job Storage permissionin their Permission Set to delete the job;otherwise, delete access is denied.

For encrypted stored print jobs: From theControl Panel, subjects must know the job'sJob Encryption Password or have theappropriate Job Storage permission in theirPermission Set to delete D.DOC; otherwise,delete access is denied.

DSR,For print jobs in Job Storage with the Job PINattribute set: Subjects must be the job owneror know the Job PIN to read the object;otherwise, read access is denied.

U.NORMALReadD.DOC+DSR

D.DOC+PRT PRT

For encrypted stored print jobs: Subjects mustknow the job's Job Encryption Password toread the object, otherwise, read access isdenied.

Table 25: Common Access Control SFP

6.1.3.2 TOE function access control SFP (FDP_ACC.1-tfac)The TSF shall enforce the TOE Function Access Control SFP on users assubjects, TOE functions as objects, and the right to use the functionsas operations.

FDP_ACC.1.1






6.1.3.3 Common access control functions (FDP_ACF.1-cac)The TSF shall enforce the Common Access Control SFP in Table 25 to objectsbased on the following: the list of users as subjects and objects controlledunder the Common Access Control SFP in Table 25, and for each, theindicated security attributes in Table 25.

FDP_ACF.1.1

The TSF shall enforce the following rules to determine if an operation amongcontrolled subjects and controlled objects is allowed: rules specified in theCommon Access Control SFP in Table 25 governing access amongcontrolled users as subjects and controlled objects using controlledoperations on controlled objects.

FDP_ACF.1.2

The TSF shall explicitly authorise access of subjects to objects based on thefollowing additional rules:

FDP_ACF.1.3

● U.ADMINISTRATOR can delete any D.DOC without providing a JobPIN or Job Encryption Password.

The TSF shall explicitly deny access of subjects to objects based on the followingadditional rules: none.

FDP_ACF.1.4

6.1.3.4 TOE function access control functions (FDP_ACF.1-tfac)The TSF shall enforce the TOE Function Access Control SFP to objects basedon the following: users and the following TOE functions and securityattributes:

FDP_ACF.1.1

● Users: Control Panel users;Functions: F.DSR, F.PRT, F.SMI;Security attributes:❍ User Role as defined by the user's Permission Set❍ Association of a sign in method to a Control Panel application

● Users: Network Client Computers, Administrative Computer;Functions: F.DSR, F.PRT, F.SMI;Security attributes:❍ User Role as defined by the user's IPsec/Firewall service

templates.

Application Note: The "Allow users to choose alternate sign-in methods"checkbox affects the sign in processing behavior of Control Panel users, but isconsidered a function instead of a security attribute and, thus, not listed under"security attributes" above.

The TSF shall enforce the following rules to determine if an operation amongcontrolled subjects and controlled objects is allowed:

FDP_ACF.1.2

● The user is explicitly authorized by U.ADMINISTRATOR to use afunction

● A Network Client Computer that is authorized to use the TOE isautomatically authorized to use the functions F.DSR, F.PRT, F.SMI.

The TSF shall explicitly authorise access of subjects to objects based on thefollowing additional rules: the user acts in the role U.ADMINISTRATOR,none.

FDP_ACF.1.3






The TSF shall explicitly deny access of subjects to objects based on the followingadditional rules: none.

FDP_ACF.1.4

6.1.3.5 Subset residual information protection (FDP_RIP.1)The TSF shall ensure that any previous information content of a resource is madeunavailable upon the deallocation of the resource from the following objects:D.DOC.

FDP_RIP.1.1

6.1.4 Identification and authentication (FIA)

6.1.4.1 Local user attribute definition (FIA_ATD.1)The TSF shall maintain the following list of security attributes belonging toindividual users:

FIA_ATD.1.1

● Control Panel users:❍ User Identifier (Access Code and Display Name) for Local Device

Sign In❍ User Role (defined by Permission Set)

● IPsec users:❍ User Identifier (defined by IP address)❍ User Role (defined by IPsec/Firewall service template)

Application Note:The LDAP and Windows Sign In method security attributes belonging to individual users are not inFIA_ATD.1 because these attributes are "maintained" independently by the LDAP server andWindowsdomain controller, respectively, which are part of the Operational Environment.

6.1.4.2 Verification of secrets (FIA_SOS.1)The TSF shall provide a mechanism to verify that secrets meet the requirement:Job PINs shall be 4 digits.

FIA_SOS.1.1

6.1.4.3 Timing of Control Panel authentication (FIA_UAU.1)The TSF shall allow viewing of the Control Panel help screens and selectionof a sign in method on behalf of the Control Panel user to be performed beforethe user is authenticated.

FIA_UAU.1.1

The TSF shall require each Control Panel user to be successfully authenticatedbefore allowing any other TSF-mediated actions on behalf of that user.

FIA_UAU.1.2

6.1.4.4 IPsec authentication before any action (FIA_UAU.2)The TSF shall require each Network Client Computer, Administrative Computer,and trusted IT product connection user to be successfully authenticated beforeallowing any other TSF-mediated actions on behalf of that connection user.

FIA_UAU.2.1






6.1.4.5 Control Panel protected authentication feedback (FIA_UAU.7)The TSF shall provide only asterisk characters (touchscreen models) or dotcharacters (4-line display models) for each

FIA_UAU.7.1

● Access Code digit typed● Authentication password character typed● Job PIN digit typedto the user while the Control Panel authentication is in progress.

Application Note: Job PINs are not used for authentication, but the digits are masked whenentered.

6.1.4.6 Timing of Control Panel identification (FIA_UID.1)The TSF shall allow viewing of the Control Panel help screens and selectionof a sign in method on behalf of the Control Panel user to be performed beforethe user is identified.

FIA_UID.1.1

The TSF shall require each Control Panel user to be successfully identified beforeallowing any other TSF-mediated actions on behalf of that user.

FIA_UID.1.2

6.1.4.7 IPsec identification before any action (FIA_UID.2)The TSF shall require each Network Client Computer, Administrative Computer,and trusted IT product connection user to be successfully identified before allowingany other TSF-mediated actions on behalf of that connection user.

FIA_UID.2.1

6.1.4.8 User-subject binding (FIA_USB.1)The TSF shall associate the following user security attributes with subjects actingon the behalf of that user: User Identifier (Display Name for Local DeviceSign In, user name for both LDAP Sign In andWindows Sign In, IP addressfor IPsec) and User Role.

FIA_USB.1.1

The TSF shall enforce the following rules on the initial association of user securityattributes with subjects acting on behalf of users: If "Allow users to choosealternate sign-in methods" is disabled, the user's session Permission

FIA_USB.1.2

Set will be reduced to exclude the permissions of applications whosesign in method does not match the sign in method used by the user tosign in..The TSF shall enforce the following rules governing changes to the user securityattributes associated with the subjects acting on the behalf of users: none.

FIA_USB.1.3

6.1.5 Security management (FMT)

6.1.5.1 Management of authentication security functions behavior(FMT_MOF.1)

The TSF shall restrict the ability to enable, disable the functions "Allow usersto choose alternate sign-in methods" for Control Panel applications toU.ADMINISTRATOR.

FMT_MOF.1.1






6.1.5.2 Management of Permission Set security attributes(FMT_MSA.1-perm)

The TSF shall enforce the Common Access Control SFP in Table 25 and TOEFunction Access Control SFP to restrict the ability tomodify, create, deletethe security attributes Permission Sets and Permission Set associations toU.ADMINISTRATOR.

FMT_MSA.1.1

6.1.5.3 Management of TOE function security attributes (FMT_MSA.1-tfac)The TSF shall enforce the TOE Function Access Control SFP to restrict theability to perform the following operations on the security attributes

FMT_MSA.1.1

● IPsec/Firewall service templates (defining IPsec User Roles): create,modify, delete operations

● Association of a sign in method to a Control Panel application: modifyoperation

to U.ADMINISTRATOR.

6.1.5.4 Management of TSF data (FMT_MTD.1-auth)The TSF shall restrict the ability to perform operations specified below forthe

FMT_MTD.1.1

● IPsec CA X.509v3 certificate: add, replace, delete operations● IPsec identity X.509v3 certificate: replace operation● IPsec/Firewall address templates and rules for IPsec users: create,

modify, delete operations● IPsec/Firewall address templates, service templates, and rules for

trusted IT products: create, modify, delete operationsto U.ADMINISTRATOR.

6.1.5.5 Management of TSF data (FMT_MTD.1-users)The TSF shall restrict the ability tomodify, delete, initialize the Device UserAccounts to U.ADMINISTRATOR.

FMT_MTD.1.1

6.1.5.6 Specification of management functions (FMT_SMF.1)The TSF shall be capable of performing the following management functions:FMT_SMF.1.1● IPsec/Firewall rules, address templates, and service templates

management (FMT_MSA.1-tfac, FMT_MTD.1-auth)● IPsec X.509v3 certificate management (FMT_MTD.1-auth)● Local Device Sign In data (Access Code) management

(FMT_MTD.1-users)● Permission Set management (FMT_MSA.1-perm)● Sign in method association management (FMT_MOF.1,

FMT_MSA.1-tfac).






6.1.5.7 Security roles (FMT_SMR.1)The TSF shall maintain the roles U.ADMINISTRATOR, U.NORMAL.FMT_SMR.1.1The TSF shall be able to associate users with roles.FMT_SMR.1.2

6.1.6 Protection of the TSF (FPT)

6.1.6.1 Restricted forwarding of data to external interfaces(FPT_FDI_EXP.1)

The TSF shall provide the capability to restrict data received on any externalInterface from being forwarded without further processing by the TSF to anyShared-medium Interface.

FPT_FDI_EXP.1.1

Application Note: The Shared-medium Interface is the only external interface (using the externalinterface definition from [PP2600.2]) on this HCD in the evaluated configuration.

6.1.6.2 Reliable time stamps (FPT_STM.1)The TSF shall be able to provide reliable time stamps.FPT_STM.1.1

6.1.6.3 TSF testing (FPT_TST.1)The TSF shall run a suite of self tests at the request of the authorised userto demonstrate the correct operation of

FPT_TST.1.1

● System Clock - timestamp verification● Local Device Sign In - user Access Code verification● LDAP Sign In - LDAP settings verification● Windows Sign In (via Kerberos) - Windows Settings verification.The TSF shall provide authorised users with the capability to verify the integrityof

FPT_TST.1.2

● Local Device Sign In database● Device Administrator Password● User and administrator authentication configuration data (including

Permission Sets and sign-in method assigned to top-level ControlPanel application).

The TSF shall provide authorised users with the capability to verify the integrityof stored TSF executable code.

FPT_TST.1.3

6.1.7 TOE access (FTA)

6.1.7.1 Control Panel TSF-initiated termination (FTA_SSL.3)The TSF shall terminate an a Control Panel interactive session after a:FTA_SSL.3.1● A period of time, configurable by U.ADMINISTRATOR, of user

inactivity.






6.1.8 Trusted path/channels (FTP)

6.1.8.1 Inter-TSF trusted channel (FTP_ITC.1)The TSF shall provide a communication channel between itself and another trustedIT product that is logically distinct from other communication channels andprovides assured identification of its end points and protection of the channelcommunicated data from modification or disclosure.

FTP_ITC.1.1

The TSF shall permit the TSF, another trusted IT product to initiatecommunication via the trusted channel.

FTP_ITC.1.2

The TSF shall initiate communication via the trusted channel for communicationof D.DOC, D.FUNC, D.PROT, and D.CONF over any Shared-mediumInterface.

FTP_ITC.1.3

6.2 Security Functional Requirements Rationale

6.2.1 CoverageThe following table provides a mapping of SFR to the security objectives, showing that each securityfunctional requirement addresses at least one security objective.

ObjectivesSecurity functional requirements

O.AUDIT.LOGGEDFAU_GEN.1

O.AUDIT.LOGGEDFAU_GEN.2

O.CONF.NO_ALT,O.CONF.NO_DIS,O.DOC.NO_ALT,O.DOC.NO_DIS,O.FUNC.NO_ALT,O.PROT.NO_ALT

FCS_CKM.1


FCS_CKM.2


FCS_COP.1-ipsec

O.DOC.NO_ALT,O.DOC.NO_DIS

FCS_COP.1-job







O.DOC.NO_ALT,O.DOC.NO_DIS,O.FUNC.NO_ALT

FDP_ACC.1-cac

O.USER.AUTHORIZEDFDP_ACC.1-tfac

O.DOC.NO_ALT,O.DOC.NO_DIS,O.FUNC.NO_ALT

FDP_ACF.1-cac

O.USER.AUTHORIZEDFDP_ACF.1-tfac

O.DOC.NO_DISFDP_RIP.1

O.USER.AUTHORIZEDFIA_ATD.1

O.USER.AUTHORIZEDFIA_SOS.1

O.INTERFACE.MANAGED,O.USER.AUTHORIZED

FIA_UAU.1


FIA_UAU.2

O.CONF.NO_DISFIA_UAU.7

O.AUDIT.LOGGED,O.CONF.NO_ALT,O.CONF.NO_DIS,O.DOC.NO_ALT,O.DOC.NO_DIS,O.FUNC.NO_ALT,O.INTERFACE.MANAGED,O.PROT.NO_ALT,O.USER.AUTHORIZED

FIA_UID.1

O.AUDIT.LOGGED,O.CONF.NO_ALT,O.CONF.NO_DIS,O.DOC.NO_ALT,O.DOC.NO_DIS,O.FUNC.NO_ALT,O.INTERFACE.MANAGED,O.PROT.NO_ALT,O.USER.AUTHORIZED

FIA_UID.2

O.USER.AUTHORIZEDFIA_USB.1

O.PROT.NO_ALTFMT_MOF.1

O.DOC.NO_ALT,O.DOC.NO_DIS,O.FUNC.NO_ALT,O.USER.AUTHORIZED

FMT_MSA.1-perm

O.USER.AUTHORIZEDFMT_MSA.1-tfac







O.CONF.NO_ALT,O.CONF.NO_DIS,O.PROT.NO_ALT

FMT_MTD.1-auth

O.CONF.NO_ALT,O.CONF.NO_DIS,O.PROT.NO_ALT

FMT_MTD.1-users


FMT_SMF.1

O.CONF.NO_ALT,O.CONF.NO_DIS,O.DOC.NO_ALT,O.DOC.NO_DIS,O.FUNC.NO_ALT,O.PROT.NO_ALT,O.USER.AUTHORIZED

FMT_SMR.1

O.INTERFACE.MANAGEDFPT_FDI_EXP.1

O.AUDIT.LOGGEDFPT_STM.1

O.SOFTWARE.VERIFIEDFPT_TST.1


FTA_SSL.3


FTP_ITC.1

Table 26: Mapping of security functional requirements to security objectives

6.2.2 SufficiencyThe following rationale provides justification for each security objective for the TOE, showing thatthe security functional requirements are suitable to meet and achieve the security objectives:

RationaleSecurity objectives

The objective:O.AUDIT.LOGGED● The TOE shall create and maintain a log of TOE use and

security-relevant events, and prevent its unauthorized disclosureor alteration.







is met by:● FAU_GEN.1 which enforces audit policies by requiring logging of

relevant events.● FAU_GEN.2 which enforces audit policies by requiring logging of

information associated with audited events.● FIA_UID.1 and FIA_UID.2 which support audit policies by associating

user identity with events● FPT_STM.1 which supports audit policies by requiring time stamps

associated with events.

The objective:O.CONF.NO_ALT● The TOE shall protect TSF Confidential Data from unauthorized

alteration.

is met by:● FCS_CKM.1 which specifies the type of cryptographic keys

generated by the TOE for use with HMAC algorithms in IPsec.● FCS_CKM.2 which specifies the cryptographic key distribution

methods used by the TOE in IKEv1 and IKEv2 in IPsec.● FCS_COP.1-ipsec which specifies the RSA decryption algorithms

and HMAC algorithms used by the TOE.● FIA_UID.1 and FIA_UID.2 which support access control and security

roles by requiring user identification.● FMT_MTD.1-auth and FMT_MTD.1-users which enforce protection

by restricting access.● FMT_SMF.1 which supports control of security attributes by requiring

functions to control attributes.● FMT_SMR.1 which supports control of security attributes by requiring

security roles.● FTP_ITC.1 which enforces protection by requiring the use of trusted

channels for communication of data over Shared-medium Interfaces.

The objective:O.CONF.NO_DIS● The TOE shall protect TSF Confidential Data from unauthorized

disclosure.


generated by the TOE for use with AES in IPsec.● FCS_CKM.2 which specifies the cryptographic key distribution

methods used by the TOE in IKEv1 and IKEv2 in IPsec.● FCS_COP.1-ipsec which specifies the AES encryption/decryption

algorithms and the RSA decryption algorithms used by the TOE inIPsec.

● FIA_UAU.7 which masks the display of certain passwords and PINsduring authentication.

● FIA_UID.1 and FIA_UID.2 which support access control and securityroles by requiring user identification.







● FMT_MTD.1-auth and FMT_MTD.1-users which enforce protectionby restricting access.

● FMT_SMF.1 which supports control of security attributes by requiringfunctions to control attributes.

● FMT_SMR.1 which supports control of security attributes by requiringsecurity roles.

● FTP_ITC.1 which enforces protection by requiring the use of trustedchannels for communication of data over Shared-medium Interfaces.

The objective:O.DOC.NO_ALT● The TOE shall protect User Document Data from unauthorized

alteration.




used by the TOE and the HMAC algorithms used by the TOE in IPsec.● FCS_COP.1-job which specifies the AES decryption algorithm used

by the TOE to process encrypted jobs.● FDP_ACC.1-cac which enforces protection by establishing an access

control policy.● FDP_ACF.1-cac which supports access control policy by providing

access control function.● FIA_UID.1 and FIA_UID.2 which support access control and security

roles by requiring user identification.● FMT_MSA.1-perm which supports access control function by

enforcing control of security attributes.● FMT_SMF.1 which supports control of security attributes by requiring




The objective:O.DOC.NO_DIS● The TOE shall protect User Document Data from unauthorized

disclosure.


generated by the TOE for use with AES in IPsec.● FCS_CKM.2 which specifies the cryptographic key distribution

methods used by the TOE in IKEv1 and IKEv2 in IPsec.







● FCS_COP.1-ipsec which specifies the AES encryption/decryptionalgorithms and the RSA decryption algorithms used by the TOE inIPsec.

● FCS_COP.1-job which specifies the AES decryption algorithm usedby the TOE to process encrypted jobs.

● FDP_ACC.1-cac which enforces protection by establishing an accesscontrol policy.

● FDP_ACF.1-cac which supports access control policy by providingaccess control function.

● FDP_RIP.1 which enforces protection by making residual dataunavailable.

● FIA_UID.1 and FIA_UID.2 which support access control and securityroles by requiring user identification.

● FMT_MSA.1-perm which supports access control function byenforcing control of security attributes.

● FMT_SMF.1 which supports control of security attributes by requiringfunctions to control attributes.

● FMT_SMR.1 which supports control of security attributes by requiringsecurity roles.

● FTP_ITC.1 which enforces protection by requiring the use of trustedchannels for communication of data over Shared-medium Interfaces.

The objective:O.FUNC.NO_ALT● The TOE shall protect User Function Data from unauthorized

alteration.




used by the TOE and the HMAC algorithms used by the TOE in IPsec.● FDP_ACC.1-cac which enforces protection by establishing an access

control policy.● FDP_ACF.1-cac which supports access control policy by providing

access control function.● FIA_UID.1 and FIA_UID.2 which support access control and security

roles by requiring user identification.● FMT_MSA.1-perm which supports access control function by

enforcing control of security attributes.● FMT_SMF.1 which supports control of security attributes by requiring










The objective:O.INTERFACE.MANAGED● The TOE shall manage the operation of external interfaces in

accordance with security policies.

is met by:● FIA_UAU.1 and FIA_UAU.2 which enforce management of external

interfaces by requiring user authentication.● FIA_UID.1 and FIA_UID.2 which enforce management of external

interfaces by requiring user identification.● FPT_FDI_EXP.1 which enforces management of external interfaces

by requiring (as needed) administrator control of data transmissionfrom external Interfaces to Shared-medium Interfaces.

● FTA_SSL.3 which enforces management of external interfaces byterminating inactive sessions.

The objective:O.PROT.NO_ALT● The TOE shall protect TSF Protected Data from unauthorized

alteration.



methods used by the TOE in IKEv1 and IKEv2 in IPsec.● FCS_COP.1-ipsec which specifies the RSA decryption algorithm and

the HMAC algorithms used by the TOE in IPsec.● FIA_UID.1 and FIA_UID.2 which support access control and security

roles by requiring user identification.● FMT_MOF.1 which specifies the roles that can manage the selection

of sign in methods.● FMT_MTD.1-auth and FMT_MTD.1-users which enforce protection

by restricting access.● FMT_SMF.1 which supports control of security attributes by requiring




The objective:O.SOFTWARE.VERIFIED● The TOE shall provide procedures to self-verify executable code in

the TSF.

is met by:● FPT_TST.1 which enforces verification of software by requiring the

TOE include self-tests.

The objective:O.USER.AUTHORIZED







● The TOE shall require identification and authentication of Users,and shall ensure that Users are authorized in accordance withsecurity policies before allowing them to use the TOE.

is met by:● FDP_ACC.1-tfac which enforces authorization by establishing an

access control policy.● FDP_ACF.1-tfac which supports access control policy by providing

access control function.● FIA_ATD.1 which supports authorization by associating security

attributes with users.● FIA_SOS.1 which specifies the password/PIN strength of certain

authentication mechanisms.● FIA_UAU.1 and FIA_UAU.2 which enforce authorization by requiring

user authentication.● FIA_UID.1 and FIA_UID.2 which enforce authorization by requiring

user identification.● FIA_USB.1 which enforces authorization by distinguishing subject

security attributes associated with User Roles.● FMT_MSA.1-perm and FMT_MSA.1-tfac which support access control

function by enforcing control of security attributes.● FMT_SMR.1 which supports authorization by requiring security roles.● FTA_SSL.3 which enforces authorization by terminating inactive

sessions.

Table 27: Security objectives for the TOE rationale

6.2.3 Security requirements dependency analysisThe following table demonstrates the dependencies of SFRs modeled in CC Part 2 and how the SFRsfor the TOE resolve those dependencies:

ResolutionDependenciesSecurityFunctionalRequirement

FPT_STM.1FPT_STM.1FAU_GEN.1

FAU_GEN.1FAU_GEN.1FAU_GEN.2

FIA_UID.1FIA_UID.1







FCS_CKM.2FCS_COP.1-ipsec

[FCS_CKM.2 or FCS_COP.1]FCS_CKM.1

This dependency is unresolved. Thegenerated keys are not formally destroyed.The object reuse mechanisms of theoperating system prevent their use exceptin the intended context.

FCS_CKM.4

FCS_CKM.1[FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1]FCS_CKM.2

This dependency is unresolved. Thedistributed symmetric keys are not formallydestroyed. The object reuse mechanismsin the operating system prevent their useexcept in the intended context.

FCS_CKM.4

FCS_CKM.1[FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1]FCS_COP.1-ipsec

This dependency is unresolved. The keysused for encryption, decryption, and dataauthentication are not formally destroyed.

FCS_CKM.4

The object reuse mechanisms in theoperating system prevent their use exceptin the intended context.

This dependency is unresolved. The ClientComputer encrypts the print job prior tosending the print job to the TOE using an

[FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1]FCS_COP.1-job

AES 256-bit key derived from the user's JobEncryption Password. The TOE requires theControl Panel user to reenter the same JobEncryption Password so that the TOE canderive the same AES 256-bit key in orderto decrypt the print job.

This dependency is unresolved. The keyused for decryption is not formallydestroyed. The object reuse mechanismsin the operating system prevent their useexcept in the intended context.

FCS_CKM.4

FDP_ACF.1-cacFDP_ACF.1FDP_ACC.1-cac

FDP_ACF.1-tfacFDP_ACF.1FDP_ACC.1-tfac







FDP_ACC.1-cacFDP_ACC.1FDP_ACF.1-cac

This dependency is unresolved. The JobPIN, Job Encryption Password, andPermission Sets do not have default valuesand do not allow for the specification ofalternative initial values.

FMT_MSA.3

FDP_ACC.1-tfacFDP_ACC.1FDP_ACF.1-tfac

This dependency is unresolved. The IPservice templates, associations of sign inmethod to a Control Panel application, and

FMT_MSA.3

Permission Sets do not have default valuesand do not allow for the specification ofalternative initial values.

No dependencies.FDP_RIP.1

No dependencies.FIA_ATD.1

No dependencies.FIA_SOS.1

FIA_UID.1FIA_UID.1FIA_UAU.1

FIA_UID.2FIA_UID.1FIA_UAU.2

FIA_UAU.1FIA_UAU.1FIA_UAU.7

No dependencies.FIA_UID.1

No dependencies.FIA_UID.2

FIA_ATD.1FIA_ATD.1FIA_USB.1

FMT_SMR.1FMT_SMR.1FMT_MOF.1

FMT_SMF.1FMT_SMF.1

FDP_ACC.1-cacFDP_ACC.1-tfac

[FDP_ACC.1 or FDP_IFC.1]FMT_MSA.1-perm

FMT_SMR.1FMT_SMR.1

FMT_SMF.1FMT_SMF.1

FDP_ACC.1-tfac[FDP_ACC.1 or FDP_IFC.1]FMT_MSA.1-tfac

FMT_SMR.1FMT_SMR.1

FMT_SMF.1FMT_SMF.1







FMT_SMR.1FMT_SMR.1FMT_MTD.1-auth

FMT_SMF.1FMT_SMF.1

FMT_SMR.1FMT_SMR.1FMT_MTD.1-users

FMT_SMF.1FMT_SMF.1

No dependencies.FMT_SMF.1

FIA_UID.1FIA_UID.1FMT_SMR.1

FMT_SMR.1FMT_SMR.1FPT_FDI_EXP.1

FMT_SMF.1FMT_SMF.1

No dependencies.FPT_STM.1

No dependencies.FPT_TST.1

No dependencies.FTA_SSL.3

No dependencies.FTP_ITC.1

Table 28: TOE SFR dependency analysis

6.2.4 Internal consistency and mutual support of SFRs

6.3 Security Assurance RequirementsThe security assurance requirements for the TOE are the Evaluation Assurance Level 2 componentsas specified in [CC] part 3, augmented by ALC_FLR.2.The following table shows the Security assurance requirements, and the operations performed onthe components according to CC part 3: iteration (Iter.), refinement (Ref.), assignment (Ass.) andselection (Sel.).

OperationsSourceSecurity assurance requirementSecurityassurance class

Sel.Ass.Ref.Iter.

NoNoNoNoCC Part 3ADV_ARC.1 Security architecture descriptionADVDevelopment

NoNoNoNoCC Part 3ADV_FSP.2 Security-enforcing functionalspecification

NoNoNoNoCC Part 3ADV_TDS.1 Basic design

NoNoNoNoCC Part 3AGD_OPE.1 Operational user guidanceAGD Guidancedocuments

NoNoNoNoCC Part 3AGD_PRE.1 Preparative procedures






OperationsSourceSecurity assurance requirementSecurityassurance class

Sel.Ass.Ref.Iter.

NoNoNoNoCC Part 3ALC_CMC.2 Use of a CM systemALC Life-cyclesupport

NoNoNoNoCC Part 3ALC_CMS.2 Parts of the TOE CM coverage

NoNoNoNoCC Part 3ALC_DEL.1 Delivery procedures

NoNoNoNoCC Part 3ALC_FLR.2 Flaw reporting procedures

NoNoNoNoCC Part 3ASE_INT.1 ST introductionASE SecurityTarget evaluation

NoNoNoNoCC Part 3ASE_CCL.1 Conformance claims

NoNoNoNoCC Part 3ASE_SPD.1 Security problem definition

NoNoNoNoCC Part 3ASE_OBJ.2 Security objectives

NoNoNoNoCC Part 3ASE_ECD.1 Extended components definition

NoNoNoNoCC Part 3ASE_REQ.2 Derived security requirements

NoNoNoNoCC Part 3ASE_TSS.1 TOE summary specification

NoNoNoNoCC Part 3ATE_COV.1 Evidence of coverageATE Tests

NoNoNoNoCC Part 3ATE_FUN.1 Functional testing

NoNoNoNoCC Part 3ATE_IND.2 Independent testing - sample

NoNoNoNoCC Part 3AVA_VAN.2 Vulnerability analysisAVA Vulnerabilityassessment

Table 29: Security assurance requirements

6.4 Security Assurance Requirements RationaleThe evaluation assurance level has been chosen to match a Basic attack potential commensuratewith the threat environment that is experienced by typical consumers of the TOE and commensuratewith [PP2600.2]. In addition, the evaluation assurance level has been augmented with ALC_FLR.2commensurate with the augmented flaw remediation capabilities offered by the developer beyondthose required by the evaluation assurance level and commensurate with [PP2600.2].






7 TOE Summary Specification

7.1 TOE Security FunctionalityThe following section explains how the security functions are implemented by the TOE. The differentTOE security functions cover the various SFR classes.The primary security features of the TOE are:

● Auditing● Cryptography● Identification and authentication● Data protection and access control● Protection of the TSF● TOE access protection● Trusted channel communication and certificate management● User and access management

7.1.1 AuditingThe TOE performs auditing of security relevant functions. The TOE connects and sends audit recordsto a syslog server (part of the Operational Environment) for long-term storage and audit review.The records sent to the syslog server by the TOE are only those generated by the TOE while thesyslog server has an established connection with the TOE. If the connection between the TOE andsyslog server breaks and is later reestablished, only records generated by the TOE after theconnection is reestablished are sent to the syslog server. Both the Jetdirect Inside and HCD Systemfirmware generate audit records.The types of records generated by the TOE are specified in section 6.1.1.1. Each record includesthe date and time of the event, type of event, subject identity (if applicable), and the outcome(success or failure) of the event. Events resulting from actions of identified users are associatedwith the identity of the user that caused the event.The subject identity used in the audit record is formed in the following manner. For Local DeviceSign In, the subject's identity contains the user's Display Name prefixed with "LOCAL\". For LDAPSign In, the subject's identity contains the user's LDAP user name prefixed with either the LDAPserver's host name or IP address then a backslash. For Windows Sign In, the subject's identitycontains the user's Windows domain name and Windows user name separated by a "\". For IPsec,the subject's identity is the user's IP address.The time source used for the audit record timestamps is discussed in section 7.1.5.3.This section maps to the following SFRs:

● FAU_GEN.1● FAU_GEN.2

7.1.2 CryptographyThe TOE uses IPsec to protect its communications channels. The QuickSec cryptographic library,which is part of the Operational Environment, is used to supply the cryptographic algorithms forIPsec. See section 7.1.7 for more information.






The TOE supports the decrypting of print jobs encrypted using the Job Encryption Password. Thedecryption code used by the TOE is included in the TOE. See section 7.1.4.3 for more information.

7.1.3 Identification and authentication (I&A)The TOE supports multiple Control Panel sign in methods, both local and remote methods. It alsosupports IPsec identification and mutual authentication.The following interfaces support I&A:

● Control Panel● IPsec

7.1.3.1 Control Panel I&AThe Control Panel interface supports both local and remote sign in methods. The following sign inmethods are allowed with the evaluated configuration:

● Local sign in method:❍ Local Device Sign In

● Remote sign in methods:❍ LDAP Sign In❍ Windows Sign In (via Kerberos)

(The servers for the remote sign in methods are part of the Operational Environment.)The Control Panel also allows both non-administrative users (U.NORMAL) and administrative users(U.ADMINISTRATOR) to sign in. Prior to sign in, the Control Panel allows users to select a sign inmethod, sign in to the TOE, or get help on various printer functions.Local Device Sign In is only available through the Control Panel. The TOE contains a local userdatabase for defining non-administrative (U.NORMAL, by default) device user accounts used tosupport the Local Device Sign In mechanism. Each device user account contains the followingsecurity attributes:

● Access Code (8 digits)● Display Name● Permission Set

The Access Code is a number that serves as both the login user identifier and the authenticationsecret. Each user's Access Code is unique from all other Local Device users. In the evaluatedconfiguration, the Access Code length must be 8 digits, which is the largest length for an AccessCode allowed by the TOE. The length of the Access Code is manually enforced by the administrator.The one exception is the Local Device Administrator Access Code, also known as the DeviceAdministrator Password. While stored on the device, this password can be as long as 16 charactersand composed of letters, numbers, and special characters. The Device Administrator Password canalso be used to sign in to EWS or the Web Services interface from a remote computer in additionto signing in at the Control Panel.The Display Name is a unique name assigned to the account by the administrator. This name is asecurity attribute because it is used in audit records to identify the user. (The Access Code is notwritten in the audit records.)The Permission Set defines/determines a user's access to many of the TOE's functions. PermissionSets are discussed in more detail in section 7.1.4.1.






Like Local Device Sign In, the remote sign in methods are only used by the Control Panel. The TOEreceives authentication credentials from the Control Panel users and passes the credentials to theremote sign in method. The remote sign in method returns an authentication decision to the TOE.This decision is then enforced by the TOE by granting or denying access to the Control Panel user.In the case of LDAP, the user name and password entered at the Control Panel are used to bind tothe LDAP server. The user must have a valid and active LDAP account in order to successfully bindusing this method.In the case of Kerberos, the user name and password entered at the Control Panel are used toauthenticate with the Windows domain controller. The user must have a valid and active Windowsdomain account in order to successfully bind using this method.When a user successfully logs in to the Control Panel, the Permission Set associated with that useris bound to that user instance and defines the user's User Role.When users authenticate through the Control Panel, the TOE displays an asterisk character(touchscreen models) or a dot character (4-line display models) for each character of a PIN, AccessCode, or password typed to prevent onlookers from viewing another user's authentication data.(Job PINs are not authentication data, but the Job PIN is masked.)This section maps to the following SFRs:

● FIA_ATD.1 (Access Code, User Role)● FIA_UAU.1● FIA_UAU.7● FIA_UID.1● FIA_USB.1● FMT_SMR.1

7.1.3.2 IPsec I&AThe TOE uses IPsec to identify and mutually authenticate the following user types:

● Administrative Computer (U.ADMINISTRATOR)● Network Client Computers (U.NORMAL)

IPsec uses IP addresses and X.509v3 certificates via the IKE protocols (IKEv1 and IKEv2) to identifyand authenticate, respectively, a client computer. The TOE contains an X.509v3 identity certificateand an X.509v3 CA certificate to use for the IPsec mutual authentication. The TOE does not maintainindividual X.509v3 certificates of its client computers.The User Identity of a client computer is its IP address. The TOE's internal firewall maintains lists(IPsec/Firewall address templates) of IP addresses of client computers that can connect to the TOEas a Network Client Computer and as the Administrative Computer. If a client computer has anunrecognized IP address that is not defined in the IPsec/Firewall as either the AdministrativeComputer or a Network Client Computer, then the client computer is not allowed to connect to theTOE. Similarly, if the client computer presents an invalid or unknown (unrecognized CA) X.509v3certificate, the IPsec mutual authentication mechanism will fail.The TOE also uses IP addresses and X.509v3 certificates via the IKE protocols to connect to andidentify other trusted IT products. See section 7.1.7 for more details.The TOE supports the following versions of the IKE protocol:

● IKEv1 ([RFC2409] and [RFC4109])






● IKEv2 ([RFC4306] and [RFC4718])The TOE must use IKE Main Mode for key exchange in the evaluated configuration.Mutual identification and authentication must be completed before any tasks can be performed bya Network Client Computer or an Administrative Computer.The service templates define the User Role of a client computer. The following service templatesare used to define the TOE's User Roles for IPsec users:

● All Services (U.ADMINISTRATOR)● Client Computers (U.NORMAL)

The All Services service template is provided with the TOE. The Client Computers service templateis created by the administrator as part of the TOE's configuration guidance.Both the Administrative Computer and the Network Client Computers can access the PJL Interfaceon port 9100, but only the Administrative Computer can access the EWS (HTTP) interface, WebServices interface (OXPd and WS-*), and SNMP interface.IP address management is discussed in section 7.1.4.5. Certificate management is discussed insection 7.1.7.This section maps to the following SFRs:

● FIA_ATD.1● FIA_UAU.2● FIA_UID.2● FIA_USB.1● FMT_SMR.1

7.1.4 Data protection and access control

7.1.4.1 Permission SetsFor Control Panel users, the TOE uses a user's User Role (as determined by each user's PermissionSet) to determine a user's access to many TOE functions. Only U.ADMINISTRATOR can create,modify, and delete Permission Sets. In addition, only U.ADMINISTRATOR can create, modify, anddelete the Permission Set associations to users. By default, the TOE includes the following PermissionSets:

● Device Administrator (U.ADMINISTRATOR)● Device User (U.NORMAL)

Permissions in a Permission Set include permissions as high-level as print. They also include moregranular permissions that control administrative functions like the ability to delete any Job Storagejob. Each permission in a Permission Set has two possible values: allowed and disallowed.This section maps to the following SFRs:

● FIA_ATD.1 (Permission Set)● FIA_USB.1● FMT_MSA.1-perm● FMT_SMF.1






7.1.4.2 Job PINsUsers can control access to each print job that they place under the TOE's control by assigning aJob PIN to each job. A Job PIN limits access to a stored print job while the job resides under theTOE's control and allows a user to control when the job is printed so that physical access to thehard copies can be controlled by the user. A Job PIN must be 4 digits (0000-9999) in length. Onlyone Job PIN is permitted per job.A Job PIN can only be assigned to a job at job creation time. They cannot be assigned after the jobalready resides under the TOE's control. A user assigns a Job PIN to a print job at the client computer.The Job PIN is embedded in the print job by the client computer prior to sending the print job to theTOE. Once the TOE receives a print job containing a Job PIN, the TOE enforces the Job PIN embeddedin that job.Once a Job PIN is set on a job and the job resides under the TOE's control, the Job PIN cannot bemodified or deleted (i.e., the TOE does not provide the ability to manage Job PINs).A job with a Job Encryption Password cannot be assigned a Job PIN.This section maps to the following SFRs:

● FIA_SOS.1

7.1.4.3 Job Encryption PasswordsThe TOE can store and decrypt encrypted stored print jobs received from a client computer. Astored print job is first encrypted by the client computer using a user-specified Job EncryptionPassword and AES-256 in CBCmode. The job is then sent encrypted to the TOE and stored encryptedby the TOE. To decrypt the job, a Control Panel user must enter the correct Job Encryption Passwordused to encrypt the job. The decryption algorithm is included in the TOE. Only one Job EncryptionPassword is permitted per job.A Job Encryption Password can only be assigned to a job at job creation time. A user assigns a JobEncryption Password to a print job via the client computer. Once a Job Encryption Password is seton a job, it cannot be changed or removed. In addition, a job with a Job Encryption Password cannotbe assigned a Job PIN.Because the encryption of a job is controlled by the Operational Environment, not the TOE, the TOEhas no control over the character composition and complexity of the Job Encryption Passwordchosen by the user. With that said, TOE printer models M712 and M750 can only decrypt jobs withJob Encryption Passwords containing 4 to 12 digits. All other TOE printer models can decrypt jobswith Job Encryption Passwords containing 4 to 32 alphanumeric characters.This section maps to the following SFRs:

● FCS_COP.1-job

7.1.4.4 Common access controlThe TOE protects each print job in Job Storage from non-administrative users through the use of auser identifier and a Job PIN or through the use of a Job Encryption Password. The user identifierfor a print job received from a client computer is either assigned by that client computer or assignedby the user sending the print job from the client computer. Every print job in Job Storage is assignedeither a Job PIN or a Job Encryption Password by the user at job creation time. If the TOE receivesa print job from a client computer without either a Job PIN or a Job Encryption Password, the TOEcancels the job.






The User Role, as defined by the user's Permission Set, defines each user's access. The defaultrules for a non-administrative U.NORMAL User Role for accessing a print job in Job Storage are:

● if the job is Job PIN protected:❍ the job owner (i.e., the authenticated user who matches the job's user identifier)

can access (read/delete D.DOC) the job without supplying the Job PIN❍ any non-owner authenticated user who supplies the correct Job PIN can access

(read/delete D.DOC) the job● if the job is Job Encryption Password protected, any authenticated user who supplies the

correct Job Encryption Password can access (read/delete D.DOC) the jobBy default, a Control Panel administrator (U.ADMINISTRATOR) has a permission in their PermissionSet that allows them to delete Job Storage jobs (D.DOC).This section maps to the following SFRs:

● FDP_ACC.1-cac● FDP_ACF.1-cac

7.1.4.5 TOE function access controlThe TOE controls Control Panel access to TOE functions through the use of Permission Sets. Thehome screen sign in process assigns the Permission Set to the authenticated user's session. Thissession Permission Set becomes the user's User Role. Access to each TOE device function isconfigurable in a Permission Set by an administrator. A user can perform any function permittedin the session Permission Set. Control Panel applications (e.g., Print) use the user's Permission Setto determine which of the application's functions should be allowed or disallowed for the user. AControl Panel user can perform the [PP2600.2] functions of F.DSR, F.PRT and F.SMI as determinedby the user's Permission Set.Each Control Panel application requires the user to have one or more specific permissions in theirsession Permission Set in order to access that application. In addition, the TOE's administrator canmap sign in methods to each Control Panel application and require the user to be authenticated tothat sign in method in order to access that application. The individual applications only check andenforce permissions. They do not check the sign in methods. Instead, the TOE enforces the sign inmethod requirement at the time that the user signs in to the TOE by removing permissions fromthe user's session Permission Set for each application in which the user's sign in method does notmatch the sign in method required by the TOE. By removing the permissions required by eachnon-matching application, the TOE limits the set of applications that the user can access.Administrators can change/modify the sign in method mapped to each application. In addition, theTOE contains a checkbox that allows administrators to select if the sign in method applicationmappings are enforced or ignored by the TOE. This checkbox is called "Allow users to choosealternate sign-in methods." When this checkbox is disabled, the TOE enforces the "sign in methodto application" mappings and prunes (reduces) the user's session Permission Set accordingly. Whenthis checkbox is enabled, the sign in method mappings are ignored by the TOE and the user'ssession Permission Set remains unchanged.For IPsec users, the TOE uses the IPsec/Firewall to control access to the supported network protocols.The IPsec/Firewall contains the IP addresses of authorized client computers grouped into addresstemplates and the network service protocols grouped into service templates. The administratormaps an address template to a service template using an IPsec/Firewall rule. Service templates,






therefore, act as the User Roles for IPsec users. IP addresses of computers not contained in a ruleare denied access to the TOE. The [PP2600.2] functions available to an authorized client computerare F.DSR, F.PRT, and F.SMI.This section maps to the following SFRs:

● FDP_ACC.1-tfac● FDP_ACF.1-tfac● FIA_USB.1● FMT_MOF.1

7.1.4.6 Residual information protectionWhen the TOE deletes an object defined in section 6.1.3.5, the contents of the object are no longeravailable to TOE users.This section maps to the following SFR:

● FDP_RIP.1

7.1.5 Protection of the TSF

7.1.5.1 Restricted forwarding of data to external interfacesThe TOE does not allow forwarding of data to an external interface. The TOE contains only oneexternal interface in the evaluated configuration and that interface is the Shared-medium Interface.This section maps to the following SFR:

● FPT_FDI_EXP.1

7.1.5.2 TSF self-testingThe EWS interface allows an administrator (U.ADMINISTRATOR) to execute a set of correct operationstests, TSF Data integrity tests, and integrity tests of TSF executable code. The specific securityrelated tests available to the administrator are listed in FPT_TST.1. In some cases, the tests canonly be executed if the system is configured to use the feature being tested. For example, the LDAPSettings verification test requires LDAP Sign In to be configured prior to executing the test. Thetests that may be available during self-test include:

● Timestamp verification (verify a Network Time Server is configured and responding)● Device User Access Code verification● LDAP settings verification● Windows Setting verification

This section maps to the following SFR:● FPT_TST.1

7.1.5.3 Reliable timestampsThe TOE contains a system clock that is used to generate reliable timestamps. Only administratorscan manage the system clock.The administrator must configure the device to synchronize the system clock via a Network TimeProtocol (NTP) server.






This section maps to the following SFR:● FPT_STM.1

7.1.6 TOE access protectionThe following session termination mechanisms are supported by the TOE:

● Inactivity timeout

7.1.6.1 Inactivity timeoutThe TOE supports an inactivity timeout for Control Panel sessions. If a logged in user is inactive forlonger than the specified period, the user is automatically logged off of the system. The inactivityperiod is managed by the administrator via EWS (HTTP) or withWS-* web services. Only one inactivityperiod setting exists per TOE.This section maps to the following SFR:

● FTA_SSL.3

7.1.7 Trusted channel communication and certificate managementShared-medium communications (i.e., Ethernet) between the TOE and other trusted IT productsuse a trusted channel mechanism to protect the communications from disclosure and modification.The TOE also ensures the cryptographic operations are validated during policy processing such asvalidating digital signatures or encrypting and decrypting data. The following table provides a listof the mechanism(s) used to protect these channels and the channels protected by themechanism(s).

Initiated byNetwork channelSecureprotocol

TOEEmail connections (SMTP gateway)IPsec

Administrative ComputerEWS (HTTP) connections (including web browser & certificateupload)

TOEWindows domain controller (Kerberos) connections

TOELDAP server connections

TOENTP connections

Administrative Computer &Network Client Computer

PJL connections

TOECIFS connections

Administrative ComputerSNMP connections

TOESyslog server connections

Administrative ComputerWeb Services connections (OXPd & WS-*)

Table 30: Trusted channel connections






The TOE uses IPsec as means to provide trusted channel communications. IPsec uses X.509v3certificates, the ESP, ISAKMP, IKEv1, and IKEv2 protocols, and the cryptographic algorithms listedbelow to protect communications.The cryptographic functions used by IPsec are implemented in the QuickSec cryptographic libraryversion 5.1 ([QuickSec51]) which is produced by SafeNet, Inc. The QuickSec cryptographic libraryis part of the Operational Environment, not the TOE. The TOE prepares the data and invokes theappropriate cryptographic functions, but the code in the QuickSec cryptographic library performsthe processing and calculations required. SafeNet, Inc. performs regular and rigorous developertesting of the implementation of the cryptographic algorithms in the QuickSec cryptographic library.In the evaluated configuration, the supported IPsec cryptographic algorithms are:

● RSA 1024-bit, 2048-bit, and 4096-bit (Operational Environment)● AES-128, AES-192, and AES-256 in CBC mode (Operational Environment)● HMAC-SHA1-96 (Operational Environment)● HMAC-SHA-256-128 (Operational Environment)● HMAC-SHA-384-196 (Operational Environment)● HMAC-SHA-512-256 (Operational Environment)

IPsec is conformant to the MUST/MUST NOT requirements of the following IETF RFCs:● [RFC4301] and [RFC4894] for IPsec● [RFC4303] for ESP● [RFC4306] for ISAKMP● [RFC4109] and [RFC4894] for IKEv1● [RFC4306], [RFC4718], and [RFC4894] for IKEv2.

The TOE maintains two X.509v3 certificates for IPsec in the Jetdirect certificate store:● Identity certificate● Certificate Authority (CA) certificate

The EWS (HTTP) and WS-* interfaces allow administrators to manage these X.509v3 certificatesused by IPsec.When the TOE is first powered on, the Jetdirect Inside firmware generates its own self-signed identitycertificate, however, this certificate is not permitted in the evaluated configuration. The administratoris required to replace the self-signed identity certificate created by the TOE when first powered onwith an identity certificate created outside the TOE and signed by a Certificate Authority. The TOErequires that an identity certificate always exist; therefore, it supports the ability for an administratorto replace the identity certificate.The TOE requires a CA certificate, but it does not come with a CA certificate pre-installed. Theadministrator must obtain a CA certificate from the Operational Environment, then add the CAcertificate to the TOE when configuring the TOE. The TOE allows an administrator to add, replace,and delete the CA certificate used by IPsec.This section maps to the following SFRs:

● FCS_CKM.1● FCS_CKM.2● FCS_COP.1-ipsec● FMT_MTD.1-auth






● FMT_SMF.1● FTP_ITC.1

7.1.8 User and access managementThe TOE supports the following roles:

● Administrators (U.ADMINISTRATOR)● Users (U.NORMAL)

Administrators maintain and configure the TOE and Operational Environment. Users perform thestandard print functions on the system.In addition, the TOE performs many security management functions.Only administrators can configure the list of Network Client Computers and the AdministrativeComputer that are allowed to connect to the TOE and the list of other trusted IT products to whichthe TOE will connect. Administrators do this by creating, modifying, and deleting IPsec/Firewalladdress templates, service templates, and rules via the TOE. Similarly, only administrators cancreate, modify, and delete address templates, service templates, and rules via the TOE for trustedIT products.For each Control Panel application, an administrator can modify the association of a sign in methodto an application. (for example, the administrator can associate LDAP Sign In method to the Printapplication). In addition, administrators control whether or not a Control Panel user must use theadministrator-selected sign in method associated with the applications in order to access thatapplication. This latter feature is controlled through the "Allow users to choose alternate sign-inmethods" checkbox.Administrators can initialize, modify, and delete Device User Accounts in the Local Device Sign Indatabase.It's worth noting that although the following security attributes are enforced by the TOE, the TOEdoes not provide functionality to manage these attributes (i.e., the TOE cannot add, change, delete,or query these attributes on an existing job) and the TOE does not provide default values for theseattributes; therefore, there are nomanagement SFRs specified in this ST for these security attributes:

● Job Encryption Password - The job is encrypted by the Operational Environment. The TOEdoes not provide a mechanism to change or delete the password on the job.

● Job PIN - A print job's Job PIN is set by the Operational Environment (i.e., Client Computer).The TOE does not provide a mechanism to change or delete a Job PIN from a print job.

This section maps to the following SFRs:● FMT_MOF.1● FMT_MSA.1-tfac● FMT_MTD.1-auth● FMT_MTD.1-users● FMT_SMF.1● FMT_SMR.1






8 Abbreviations, Terminology and References

8.1 AbbreviationsAES

Advanced Encryption StandardAH

Authentication Header (IPsec)ASCII

American Standard Code for Information InterchangeCA

Certificate AuthorityCBC

Cipher Block ChainingCIFS

Common Internet File SystemDNS

Domain Name SystemESP

Encapsulating Security Payload (IPsec)EWS

Embedded Web ServerHCD

Hardcopy DeviceHMAC

Hashed Message Authentication CodeHP

Hewlett-PackardHTML

Hypertext Markup LanguageHTTP

Hypertext Transfer ProtocolIEEE

Institute of Electrical and Electronics Engineers, Inc.IKE

Internet Key Exchange (IPsec)IP

Internet ProtocolIPsec

Internet Protocol SecurityISAKMP

Internet Security Association Key Management Protocol (IPsec)






LCDLiquid Crystal Display

LDAPLightweight Directory Access Protocol

MACMessage Authentication Code

NFCNear Field Communication

NTLMMicrosoft NT LAN Manager

NTPNetwork Time Protocol

OXPOpen Extensibility Platform

OXPdOXP device layer

PINPersonal Identification Number

PJLPrinter Job Language

PRFPseudo-random Function

SFRSecurity Functional Requirement

SHASecure Hash Algorithm

SMTPSimple Mail Transfer Protocol

SNMPSimple Network Management Protocol

SOAPSimple Object Access Protocol

SSDSolid-State Drive

SSHSecure Shell

TOETarget of Evaluation

USBUniversal Serial Bus






WINSWindows Internet Name Service

XMLExtensible Markup Language

8.2 TerminologyThis section contains definitions of technical terms that are used with a meaning specific to thisdocument. Terms defined in the [CC] are not reiterated here, unless stated otherwise.Administrative User

This term refers to a user with administrative control of the TOE.Authentication Data

This includes the Access Code and/or password for each user of the product.Control Panel Application

An application that resides in the firmware and is selectable by the user via the Control Panel.Device Administrator Password

The password used to restrict access to administrative tasks via EWS and the Control Panel.This password is also required to associate a user with the Administrator role. In productdocumentation, it may also be referred to as the Local Device Administrator Password, LocalDevice Administrator Access Code, the Device Password, or the Administrator Password.

External InterfaceA non-hardcopy interface where either the input is being received from outside the TOE or theoutput is delivered to a destination outside the TOE.

Hardcopy Device (HCD)This term generically refers to the product models in this Security Target.

Near Field Communication (NFC)Proximity (within a few inches) radio communication between two or more devices.

Shared-medium InterfaceMechanism for transmitting or receiving data that uses wired or wireless network or non-networkelectronic methods over a communications medium which, in conventional practice, is or canbe simultaneously accessed by multiple users.

User Security AttributesDefined by functional requirement FIA_ATD.1, every user is associated with one or more securityattributes which allow the TOE to enforce its security functions on this user.

Wireless DirectWireless local area network (Wi-Fi) support.






8.3 References

Common Criteria for Information Technology Security EvaluationCC3.1R4VersionSeptember 2012Datehttp://www.commoncriteriaportal.org/files/ccfiles/CCPART1V3.1R4.pdfLocationhttp://www.commoncriteriaportal.org/files/ccfiles/CCPART2V3.1R4.pdfLocationhttp://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R4.pdfLocation

NIAP CCEVS Policy Letter #20CCEVS-PL202010-11-15Datehttp://www.niap-ccevs.org/Documents_and_Guidance/ccevs/policy-ltr-20.pdf

Location

Advanced Encryption StandardFIPS1972001-11-26Datehttp://csrc.nist.gov/publications/fips/fips197/fips-197.pdfLocation

Public-Key Cryptography Standard (PKCS) #1: RSA Encryption StandardPKCS1v1.5RSA LaboratoriesAuthor(s)1.5VersionNovember 1993Date

IEEE Std 2600.2-2009; "2600.2-PP, Protection Profile for HardcopyDevices, Operational Environment B" (with NIAP CCEVS Policy Letter #20)

PP2600.2

1.0VersionDecember 2009Datehttp://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdfLocation

SFR Package for Hardcopy Device Document Storage and Retrieval (DSR)Functions

PP2600.2-DSR

1.0VersionDecember 2009Datehttp://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdfLocation

SFR Package for Hardcopy Device Print FunctionsPP2600.2-PRT1.0VersionDecember 2009Datehttp://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdfLocation

SFR Package for Hardcopy Device Shared-medium Interface FunctionsPP2600.2-SMI1.0VersionDecember 2009Datehttp://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdfLocation

QuickSec 5.1 Toolkit Reference ManualQuickSec51SafeNet, Inc.Author(s)1.0VersionDecember 2009Date






http://www.commoncriteriaportal.org/files/ccfiles/CCPART1V3.1R4.pdf



http://www.niap-ccevs.org/Documents_and_Guidance/ccevs/policy-ltr-20.pdf

http://www.niap-ccevs.org/Documents_and_Guidance/ccevs/policy-ltr-20.pdf

http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf

http://www.niap-ccevs.org/pp/pp_hcd_eal2_v1.0.pdf




HMAC: Keyed-Hashing for Message AuthenticationRFC2104H. Krawczyk, M. Bellare, R. CanettiAuthor(s)1997-02-01Datehttp://www.ietf.org/rfc/rfc2104.txtLocation

The Use of HMAC-SHA-1-96 within ESP and AHRFC2404C. Madson, R. GlennAuthor(s)1998-11-01Datehttp://www.ietf.org/rfc/rfc2404.txtLocation

The Internet Key Exchange (IKE)RFC2409D. Harkins, D. CarrelAuthor(s)1998-11-01Datehttp://www.ietf.org/rfc/rfc2409.txtLocation

Algorithms for Internet Key Exchange version 1 (IKEv1)RFC4109P. HoffmanAuthor(s)2005-05-01Datehttp://www.ietf.org/rfc/rfc4109.txtLocation

Security Architecture for the Internet ProtocolRFC4301S. Kent, K. SeoAuthor(s)2005-12-01Datehttp://www.ietf.org/rfc/rfc4301.txtLocation

IP Encapsulating Security Payload (ESP)RFC4303S. KentAuthor(s)2005-12-01Datehttp://www.ietf.org/rfc/rfc4303.txtLocation

Internet Key Exchange (IKEv2) ProtocolRFC4306C. KaufmanAuthor(s)2005-12-01Datehttp://www.ietf.org/rfc/rfc4306.txtLocation

IKEv2 Clarifications and Implementation GuidelinesRFC4718P. Eronen, P. HoffmanAuthor(s)2006-10-01Datehttp://www.ietf.org/rfc/rfc4718.txtLocation

Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsecRFC4868S. Kelly, S. FrankelAuthor(s)2007-05-01Datehttp://www.ietf.org/rfc/rfc4868.txtLocation

Use of Hash Algorithms in Internet Key Exchange (IKE) and IPsecRFC4894P. HoffmanAuthor(s)2007-05-01Datehttp://www.ietf.org/rfc/rfc4894.txtLocation






http://www.ietf.org/rfc/rfc2104.txt










Recommendation for Block Cipher Modes of Operation: Methods andTechniques

SP800-38A

Morris DworkinAuthor(s)NIST Special Publication 800-38A 2001 EditionVersionDecember 2001Datehttp://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdfLocation






http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf

Hewlett-Packard ColorLaserJetEnterprisePrinterM750Series ...Hewlett-Packard...

Documents

Transcript of Hewlett-Packard ColorLaserJetEnterprisePrinterM750Series ...Hewlett-Packard...